OpenCTI, Microsoft Sentinel, MISP · TAXII 2.1 PRO

The recommended method: your tool polls CTI Forecast on its own, continuously. In every case: server address https://ctiforecast.com/taxii2/, any username, password = your API key.

1. OpenCTI: enable the TAXII2 connector with TAXII2_DISCOVERY_URL=https://ctiforecast.com/taxii2/, TAXII2_USERNAME=client, TAXII2_PASSWORD=YOUR_KEY, TAXII2_V21=true and TAXII2_COLLECTIONS=*.* to fetch everything (format root.collection). Check the exact variable names in the documentation for your OpenCTI version.
2. Microsoft Sentinel: Content hub → Threat Intelligence solution → Threat Intelligence - TAXII connector. API root: https://ctiforecast.com/taxii2/api/, collection ID (see below), username client, password = your API key, polling frequency: hourly.
3. MISP: use the misp-taxii tool or a STIX 2.1 import module with the same settings.

pfSense and OPNsense · block malicious IPs

1. Firewall → Aliases, URLs tab on pfSense. On OPNsense: Firewall → Aliases, then +.
2. Type: URL Table (IPs). Name: CTI_FORECAST_IP.
3. URL: https://ctiforecast.com/v1/blocklist.txt?type=ip&days=30&key=YOUR_KEY
4. Update frequency: 1 day.
5. Create a Block firewall rule on the WAN interface (and outbound on LAN) with CTI_FORECAST_IP as source or destination.

With pfBlockerNG, add the same URL under IP → IPv4, format Auto.

Wazuh · alert when a known IP shows up in your logs

Wazuh matches logs against CDB lists in key:value format. This script downloads the list and converts it. Run it daily with cron on the manager:

#!/bin/sh
# /usr/local/bin/cti-forecast-wazuh.sh
curl -fsS "https://ctiforecast.com/v1/blocklist.txt?type=ip&days=30&key=YOUR_KEY" \
  | grep -v '^#' | sed 's/$/:cti-forecast/' > /var/ossec/etc/lists/cti-forecast-ip.tmp \
  && mv /var/ossec/etc/lists/cti-forecast-ip.tmp /var/ossec/etc/lists/cti-forecast-ip \
  && chown wazuh:wazuh /var/ossec/etc/lists/cti-forecast-ip \
  && systemctl restart wazuh-manager

Declare the list in /var/ossec/etc/ossec.conf, inside the <ruleset> section:

<list>etc/lists/cti-forecast-ip</list>

Then add a rule to /var/ossec/etc/rules/local_rules.xml:

<group name="cti_forecast,">
  <rule id="100900" level="10">
    <if_group>web|sshd|firewall</if_group>
    <list field="srcip" lookup="address_match_key">etc/lists/cti-forecast-ip</list>
    <description>CTI Forecast: known malicious IP ($(srcip))</description>
  </rule>
</group>

MISP · add CTI Forecast as a feed

1. Sync Actions → Feeds → Add Feed.
2. Source format: Freetext Parsed Feed. Input source: Network.
3. URL: https://ctiforecast.com/v1/blocklist.txt?type=sha256&days=7&key=YOUR_KEY
4. Create one feed per type (sha256, ip, domain…) so MISP files each value under the right attribute.
5. Enable the feed and caching, then Fetch and store all feed data.

OpenCTI and Microsoft Sentinel · STIX 2.1 file import PRO

Download a STIX bundle, with source articles as external references:

curl -H "X-API-Key: YOUR_KEY" -o cti-forecast.json \
  "https://ctiforecast.com/v1/stix?type=sha256,ip,domain&min_confidence=70&limit=1000"

OpenCTI: Data → Import → upload the file. STIX identifiers are stable, so re-importing the file daily updates existing indicators instead of creating duplicates.
Microsoft Sentinel: Threat intelligence → Import → from a file, STIX format.

Splunk · lookup table

Every day (cron), replace the lookup with today's list:

{ echo "ioc"; curl -fsS "https://ctiforecast.com/v1/blocklist.txt?type=ip&key=YOUR_KEY" | grep -v '^#'; } \
  > $SPLUNK_HOME/etc/apps/search/lookups/cti_forecast_ip.csv

Then, in a search: | lookup cti_forecast_ip.csv ioc AS src_ip OUTPUT ioc AS cti_match | where isnotnull(cti_match)

Another tool?

The JSON API works with anything that can make an HTTP request: Elastic, QRadar, TheHive, Python scripts or n8n.