Talk an Expert⚡ Try For Free
← Back to integrations
FIREWALL

Fortinet

Trusteed syncs dynamic attacker blocklists with Fortinet firewalls, blocking malicious IPs in real time.

How Integrations Work

  1. Ingest
    Trusteed collects raw IP traffic and correlates it with its continuously updated attacker blocklist.
  2. Filter
    Background scans, bots, and benign crawlers are filtered as noise, reducing alert volume by up to 80%.
  3. Enrich
    High-fidelity signals are enriched with risk scores and context, then exported to your existing security tools.
  4. Act
    Enriched events can be blocked, quarantined, or auto-remediated by firewalls, SIEM/SOAR pipelines, and ticketing systems.

Use Cases

Remediation
Block malicious IPs directly in your firewall, CDN, WAF, or other enforcement points. Trusteed continuously updates dynamic blocklists so attacker infrastructure is automatically contained at the edge.

Logging & Visibility
Forward enriched malicious IP intelligence to your SIEM, SOAR, or logging platform. This ensures clean, high-fidelity signals for correlation, dashboards, and automated workflows.

Fortinet Integration

The Trusteed Fortinet Integration lets you automatically enforce dynamic blocklists on Fortinet firewalls.

Prerequisites

  • A Fortinet device that supports external blocklists (FortiGate).
  • A Trusteed account with access to the blocklist feed.

Setup Steps

  1. Log into your Trusteed Console.
  2. Navigate to Integrations → Firewalls → Fortinet.
  3. Click Connect under the Fortinet logo and assign a unique integration name.
  4. Copy the credentials (displayed once) and configure them in your Fortinet firewall.
  5. The Trusteed blocklist will sync automatically in plain text format (one IP per line).

Blocklist format example:

192.168.38.187
192.168.38.186

Outcome

  • Known malicious IPs are automatically blocked at the firewall.
  • SIEM and SOAR see fewer false positives.
  • Your SOC team saves time while targeted attacks are stopped at the edge.

Next Steps

  • Browse available Trusteed blocklists in the Integration Catalog.
  • Extend integrations to other platforms (SIEM, SOAR, cloud providers).
  • Automate workflows by chaining Trusteed enrichment with your response playbooks.

‍

‍