Firewall-native Feed Format

Cybora delivers feeds as plain text. Each line contains one indicator. There is no JSON wrapper, no proprietary envelope, and no vendor-specific special format.

That sounds simple, but it matters a lot for firewalls. Many platforms expect exactly these simple remote lists when retrieving External Dynamic Lists, blocklists, aliases, or threat feeds.

Why simple is better

A plain-TXT feed has clear advantages:

• Admins can read and inspect the output directly.
• Firewalls do not need an additional parser.
• The format is robust across vendor boundaries.
• Errors are easier to identify.
• One feed can be used similarly across multiple platforms.

More complex formats are useful for analysis platforms, but not always for direct firewall operation. Cybora therefore separates internal evaluation from external delivery.

One indicator per line

The most important rule is: one indicator per line. Example for IPv4:

203.0.113.10
198.51.100.24
192.0.2.4

Networks such as CIDR blocks are not used as examples for the normal feed when the feed delivers individual indicators. This reduces import misunderstandings and matches the goal of providing clean, firewall-ready entries.

Order in the feed

The order within a feed can be understood as additional operational prioritization. Indicators with stronger evidence, higher freshness, and lower expected collateral damage are delivered higher in the list.

This does not mean that entries further down are unchecked or unsuitable for the feed. Every delivered indicator must meet the internal criteria for the relevant feed. The position in the list does not replace a public score; it reflects an internal prioritization that can make the feed more useful for firewalls with list limits or partial processing.

Concrete weights, thresholds, and scoring rules remain internal. This protects feed quality and prevents attackers or third parties from exploiting admission and prioritization logic.

Additional format details

URL structure, parameters, sample outputs, and key handling are documented in Feed URL Format and License Key.