hexfield
Home How it works Manifest Contact

Integration playbooks

Signed Hexfield artifacts are meant to land where operators already enforce and investigate: firewall aliases, Linux sets, IDS engines, Zeek, MISP/OpenCTI, routers, WAFs, DNS policy, and SIEM/EDR tooling.

Manifest/api/v1/feed-manifest
Public key/hexfield.pub
Signature ruleUse *.minisig for verification, never as a blocklist input.
Firewall appliances
URL-table aliasraw IP feed

OPNsense / pfSense

Use the raw text artifact as a URL-table or remote alias source. It contains comments followed by one bare IP per line.

https://hexfield.io/blocklist.txt
Do not paste https://hexfield.io/blocklist.txt.minisig into OPNsense or pfSense. That file is a minisign sidecar for verification tooling, not an IP list.
  • Create an alias type that expects remote IP addresses.
  • Set the content URL to https://hexfield.io/blocklist.txt.
  • Use the alias in a block/drop rule on the interfaces you protect.

Optional off-box verification before import:

curl -fSLO https://hexfield.io/blocklist.txt
curl -fSLO https://hexfield.io/blocklist.txt.minisig
curl -fSLO https://hexfield.io/hexfield.pub
minisign -Vm blocklist.txt -p hexfield.pub
Linux firewall enforcement
nftablesIPv4 / IPv6

nftables include

Download and verify the generated set definitions, then include them from your main ruleset.

curl -fsSLo /etc/nftables.d/hexfield.nft https://hexfield.io/blocklist.nft
curl -fsSLo /etc/nftables.d/hexfield.nft.minisig https://hexfield.io/blocklist.nft.minisig
curl -fsSLo /etc/nftables.d/hexfield.pub https://hexfield.io/hexfield.pub
minisign -Vm /etc/nftables.d/hexfield.nft -p /etc/nftables.d/hexfield.pub
nft -f /etc/nftables.conf

Reference the sets as @hexfield_v4 and @hexfield_v6 in your rules.

ipsetrestore input

ipset restore

Apply the signed restore input directly into persistent firewall automation.

curl -fsSLO https://hexfield.io/blocklist.ipset
curl -fsSLO https://hexfield.io/blocklist.ipset.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm blocklist.ipset -p hexfield.pub
ipset restore < blocklist.ipset

The feed creates hexfield_v4 and hexfield_v6 with -exist, so repeated runs are safe.

IDS and detection engineering
SuricataSnort-compatible

Suricata rules

Drop rules are generated from the same signed mass-scanner set.

curl -fsSLo /etc/suricata/rules/hexfield.rules https://hexfield.io/blocklist.suricata.rules
curl -fsSLo /etc/suricata/rules/hexfield.rules.minisig https://hexfield.io/blocklist.suricata.rules.minisig
curl -fsSLo /etc/suricata/rules/hexfield.pub https://hexfield.io/hexfield.pub
minisign -Vm /etc/suricata/rules/hexfield.rules -p /etc/suricata/rules/hexfield.pub
suricata-update
systemctl reload suricata

Adjust local SID policy if 9100001 or 9100002 collides with site rules.

Zeek Intel FrameworkTSV

Zeek Intel

The Zeek artifact carries IPs, URLs, domains, and SHA-256s with Intel Framework headers intact.

curl -fsSLo /opt/zeek/share/zeek/site/hexfield.zeek.intel https://hexfield.io/hexfield.zeek.intel
curl -fsSLo /opt/zeek/share/zeek/site/hexfield.zeek.intel.minisig https://hexfield.io/hexfield.zeek.intel.minisig
curl -fsSLo /opt/zeek/share/zeek/site/hexfield.pub https://hexfield.io/hexfield.pub
minisign -Vm /opt/zeek/share/zeek/site/hexfield.zeek.intel -p /opt/zeek/share/zeek/site/hexfield.pub
zeekctl deploy

Keep the tab-separated #fields header unchanged.

SigmaYARA

SIEM and EDR content

Use Sigma for VT-confirmed dropper URL paths and YARA for VT-confirmed sample hashes when present.

curl -fsSLO https://hexfield.io/hexfield.sigma.yml
curl -fsSLO https://hexfield.io/hexfield.sigma.yml.minisig
curl -fsSLO https://hexfield.io/hexfield.yara
curl -fsSLO https://hexfield.io/hexfield.yara.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm hexfield.sigma.yml -p hexfield.pub
minisign -Vm hexfield.yara -p hexfield.pub
CTI and TIP import
STIX 2.1OpenCTI

STIX bundle

Import the STIX bundle into TIP tooling that understands indicators, threat actors, ATT&CK patterns, and relationships.

curl -fsSLO https://hexfield.io/hexfield.stix.json
curl -fsSLO https://hexfield.io/hexfield.stix.json.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm hexfield.stix.json -p hexfield.pub
jq '.type, (.objects | length)' hexfield.stix.json
TAXII 2.1read-only collection

TAXII collection

Point TAXII-capable TIP/SIEM clients at the discovery URL and poll the public STIX collection.

curl -fsS https://hexfield.io/taxii2/ | jq .
curl -fsS https://hexfield.io/taxii2/api1/collections/ | jq '.collections[0].id'
curl -fsS 'https://hexfield.io/taxii2/api1/collections/hexfield-public-stix-21/objects/?match[type]=indicator' | jq '.objects | length'

Discovery URL: https://hexfield.io/taxii2/ · collection: hexfield-public-stix-21.

MISPattributes + galaxy tags

MISP event

The MISP export carries IP and payload attributes plus Hexfield confidence tags and ATT&CK galaxy tags.

curl -fsSLO https://hexfield.io/hexfield.misp.json
curl -fsSLO https://hexfield.io/hexfield.misp.json.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm hexfield.misp.json -p hexfield.pub
jq '.Event.info, (.Event.Attribute | length)' hexfield.misp.json
canonical JSONenrichment

Bulk indicator JSON

Use the canonical multi-type feed for enrichment jobs, SIEM lookups, and SDK automation.

curl -fsSLO https://hexfield.io/indicators.json
curl -fsSLO https://hexfield.io/indicators.json.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm indicators.json -p hexfield.pub
jq '.by_type' indicators.json
Router, cloud, and DNS policy
MikroTik RouterOS

RouterOS address list

RouterOS imports the address-list script; verify it off-box before copying it to the router.

curl -fsSLO https://hexfield.io/blocklist.rsc
curl -fsSLO https://hexfield.io/blocklist.rsc.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm blocklist.rsc -p hexfield.pub
# then on RouterOS:
/tool fetch url=https://hexfield.io/blocklist.rsc dst-path=hexfield.rsc
/import file-name=hexfield.rsc
AWS WAF

AWS WAF IPSet input

The AWS artifact splits IPv4 and IPv6 CIDRs for WAFv2 IPSet update workflows.

curl -fsSLO https://hexfield.io/blocklist.awswaf.json
curl -fsSLO https://hexfield.io/blocklist.awswaf.json.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm blocklist.awswaf.json -p hexfield.pub
jq '.IPV4[0:5], .IPV6[0:5]' blocklist.awswaf.json

Use your normal AWS WAF lock-token/update flow to apply the arrays.

DNS RPZ

RPZ policy zone

Load the RPZ artifact into BIND, Unbound, or PowerDNS policy workflows for DNS-layer response policy.

curl -fsSLO https://hexfield.io/blocklist.rpz
curl -fsSLO https://hexfield.io/blocklist.rpz.minisig
curl -fsSLO https://hexfield.io/hexfield.pub
minisign -Vm blocklist.rpz -p hexfield.pub
named-checkzone hexfield-rpz blocklist.rpz
SDK and automation
verified modewatch

Hexfield SDK

The SDK keeps verification in the polling loop and can emit enforcement formats directly.

python3 -m pip install hexfield
hexfield delta --verified --format nft -o /etc/nftables.d/hexfield.nft
hexfield watch --verified --interval 300 --format ipset \
  -o /etc/hexfield.ipset \
  --reload-cmd 'ipset restore < /etc/hexfield.ipset'
Automation should fail closed: if signature verification fails, keep the previous known-good artifact in place.