[PATCH] ruleset-sources: Require an Auth-Key for ThreatFox downloads

[PATCH] ruleset-sources: Require an Auth-Key for ThreatFox downloads

[Adam Gibbons]

Since 21 October 2026, ThreatFox file exports require an abuse.ch 
Auth-Key.

News link: 
https://www.linkedin.com/posts/abuse-ch_authenticate-steadyplatform-steadysignal-activity-7518660733203832832-ohAX

IPFire's ThreatFox provider still uses the unauthenticated download URL,
which prevents ruleset updates.

I have tested a two-line change that marks ThreatFox as requiring a
subscription code and uses the authenticated v2 export URL. This reuses
the existing WUI "Subscription Code" field, stored provider settings and
URL substitution.

Fixes bug report: https://bugzilla.ipfire.org/show_bug.cgi?id=14664

Signed-off-by: Adam Gibbons <adam.gibbons@ipfire.org>

---

diff --git a/config/suricata/ruleset-sources 
b/config/suricata/ruleset-sources
index 3cef7c657..71d18c780 100644
--- a/config/suricata/ruleset-sources
+++ b/config/suricata/ruleset-sources
@@ -143,8 +143,8 @@ our %Providers = (
  		summary => "ThreatFox Indicators Of Compromise Rules",
  		website => "https://threatfox.abuse.ch/",
  		tr_string => "threatfox rules",
-		requires_subscription => "False",
-		dl_url => 
"https://threatfox.abuse.ch/downloads/threatfox_suricata.rules",
+		requires_subscription => "True",
+		dl_url => 
"https://threatfox-api.abuse.ch/v2/files/exports/<subscription_code>/threatfox_suricata.rules",
  		dl_type => "plain",
  		sid_range => ["91000000", "91999999"],
  	},