Check licensing, scope and storage
Sophos Firewall 22.0 accepts complete plain-text IPv4 feeds through Active threat response. Its license requirements specify the Xstream Protection bundle for third-party feeds. Check the entitlement already installed on your appliance; a working URL does not establish licensed enforcement.
Review the storage quota and other configured feeds before importing Standard or Critical. Capacity depends on the appliance model. Start with one profile and compare the imported indicators with the complete downloaded file. A full disk can prevent the indicator list from updating even though polling continues.
Traffic scope differs from a WAN source alias. Sophos documents Active threat response requirements for internal-to-WAN traffic. For IPv4 indicators, verify the applicable firewall rule and threat exclusions. Do not treat this integration as proof of protection for every inbound or firewall-local path. See the traffic requirements and validate the path you intend to protect.
Configure the IPv4 feed
Standard
109,308 unique IPv4 addresses in this published snapshot.
https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txtCritical
119,382 unique IPv4 addresses in this published snapshot.
https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txtPublished 24 Oct 2026, 12:05 UTC. Check live counts and SHA-256.
Follow the SFOS third-party feed procedure:
- Go to Active threat response → Third-party threat feeds → Add. Name the feed
DS_STANDARD. - Choose Monitor for the initial validation, then select IPv4 address as the indicator type.
- Enter the Standard URL, select No authentication and enable Validate server certificate. Ensure the public CA chain is trusted.
- Choose a supported polling interval, such as 1 hour. On XGS 87/87w, 88/88w and 107/107w, the documented choices are 24 hours, 7 days or 30 days; use 24 hours and account for that delay.
- Test the connection, save and inspect the synchronized indicators. For Critical, use its URL with
DS_CRITICAL.
The IPv4-per-line Data-Shield format needs no conversion, CIDR expansion or credentials. Monitor records matches without blocking; change to Block only after reviewing the observed impact.
Confirm the active response
Enable Active threat response logging under System services → Log settings. Check the feed ordering and existing threat exclusions before switching the selected feed to Block. Earlier threat modules may handle the same indicator first, so inspect the corresponding module's logs. The implementation order explains this behavior.
Use a controlled connection involving an address you own and the intended traffic path. Verify the action, matching IP and feed in the logs. Merely adding a feed does not demonstrate that every traffic path is covered.
Track synchronization and removals
In the feed list, inspect Sync status, storage usage and Total indicators. Open Threat indicators to check individual addresses. Use Synchronize now when validating a new publication; Refresh updates the displayed counters. Investigate storage-full, TLS, connection and parsing errors. See Manage third-party threat feeds.
A shared whitelist correction is effective here only after the updated list is successfully imported. Keep monitoring entitlement, successful synchronization and expected membership over time. For rollback, return this feed to Monitor or disable it, then verify required traffic. Leave unrelated feeds and firewall rules intact. The procedure is documented for SFOS 22.0 and has not been certified on physical appliances.
BETTER DATA. TOGETHER.
Need a correction?
Report a documentation issue or request a review of an address. Keep credentials and private configuration out of public issues.