Connect a firewall EDL
Configure a short-lived feed with expiry and allowlists.
Prerequisites and plan required
You need an organization-bound Professional or Enterprise API key with events scope, a current organization entitlement, and permission to configure your firewall. Owners and admins manage the organization allowlist in the Console. Begin with a pilot appliance or an observation-only rule and keep a rollback procedure available.
Expected result: your appliance refreshes a list of individual public IPs, honors removals and empty successful responses, and excludes your organization's allowlisted networks. Feed membership is observed evidence, not universal reputation or proof of compromise.
1. Prepare the organization allowlist
Open Console → Integrations. Review the feed information and add trusted organization networks to the allowlist before enabling enforcement. Owners and admins can save up to 500 IPv4 or IPv6 CIDRs. Use /32 or /128 for a single address. Review CIDRs carefully: a broad exclusion can remove relevant evidence along with legitimate traffic.
The feed excludes verified or known services and reserved addresses. Shared infrastructure is observe-only unless exploit-backed. Retain your local policy for shared egress and business-critical dependencies rather than treating every match as a mandatory block.
2. Configure feed authentication
Prefer an Authorization bearer header with a dedicated organization key. The TXT feed is one individual IP per line; JSON adds confidence, reason, first_seen, last_seen and expires_at for review.
curl --fail-with-body \
-H "Authorization: Bearer YOUR_API_KEY" \
'https://mothlight.ai/api/v1/feeds/edl?format=txt'An appliance that cannot send headers can use the feed-only query-key option with the placeholder YOUR_API_KEY. Query credentials can appear in appliance logs, proxy logs and backups. Restrict access to the URL, use HTTPS and a dedicated revocable key, and plan rotation in API keys. The query-key option applies only to this feed; never assume other endpoints support it.
3. Connect your appliance
For PAN-OS, create an IP External Dynamic List using the feed URL and reference it in a reviewed security policy. For FortiGate, configure an external IP threat feed and attach it to the intended policy. For pfSense or OPNsense, configure a URL table alias and reference it in a reviewed rule. Product versions differ, so confirm the controls and IPv6 support on your appliance before enabling the rule.
Set a refresh cadence of 5–15 minutes. Confirm successful retrieval, parsed address count and policy behavior in your pilot. Professional observations are delayed 15 minutes; Enterprise has no minimum event delay. Polling more often does not remove the plan delay and consumes request capacity.
4. Verify expiry and failure behavior
Entries expire 24 hours after their last observation. The list contains at most 10,000 IPs. Verify that removed addresses disappear from the appliance cache on refresh; saving a new feed URL alone does not establish this behavior.
On generation errors, a last-good selection may be served for at most 15 minutes with current safety exclusions and expiry reapplied. Otherwise the endpoint returns an empty successful response marked X-EDL-Status: empty-on-error. Configure the appliance to replace its list on a successful empty response and test this behavior before enforcement. Monitor response status and feed age.
Troubleshooting and rollback
A 403 often means the key is not organization-bound or the current plan lacks entitlement. A 429 means request or row limits were reached. Unexpected omissions can result from expiry, delay or allowlists; inspect JSON metadata before changing policy. To roll back, disable the appliance feed and clear its cached addresses. Keep the previous policy available. For local alert corroboration, follow IP triage; for metadata-aware correlation, use SIEM enrichment.