Skip to main content
OneFirewall Alliance extracts IoC (Indicator of Compromise) data from alliance members, anonymizes and weights it, and aggregates it into a shared object used by all members for prevention. OneFirewall rewards alliance members who contribute new IoCs (IPv4, domains, files, URLs) or confirm that existing IoCs are malicious. OneFirewall also gathers data from security partners, open-source repositories, and internal security teams. The breakdown:

​
Threat Intel Source Contribution

​
Member Participation

An alliance member of OneFirewall can choose between two modes:
  • Consumer-only
    Regardless of on-prem or cloud installation, the member only consumes (reads) the latest threat intelligence.
  • Consumer-and-contributor
    The member can also report threat intelligence information back to the alliance, enhancing other members’ awareness of the latest threats.

​
Contributor

A Contributor is a member that reports IoCs — IPv4 addresses, domains, URLs, or file digests — back to the OneFirewall SaaS service, based on the organization’s internal intelligence from events flagged as malicious through automated or manual processes.

​
Outbound Data Sharing

In Contributor mode, members send data back to the OneFirewall SaaS Cloud service. Contributing members share at least the following information (in JSON format):
  • Actor: IPv4, URL, FileDigest, or domain name
  • Timestamp: Date and time of the report
  • Confidence: A numeric value (0.0 to 1.0) representing confidence in the actor’s maliciousness
  • Source (Optional): Appliance/Process used (e.g., manual, Appliance-X)
  • Event ID (Optional): Internal unique event ID
  • STIX (Optional): STIX v2.0 format bundle of the cyber attack
  • tags (Optional): Tags separated by ”,” example report-00000
In addition, contributors must authenticate against OneFirewall SaaS, which identifies the Member Organization (via random ID). This ID is used for subsequent calculations to either add a new feed or update an existing feed with enhanced confidence. The information is submitted via the OneFirewall public HTTPS/API endpoint, which updates the Cyber Crime Score based on combined intelligence from other sources.

​
Example of Data

​
Current Data Collection Plugins

  1. Manual replication of submitted events (UI on-prem instance)
  2. SIEM connector with ELK (Logstash config, case by case)
  3. Apache and NGINX ModSecurity
  4. SSH Logs
Being a contributing member implies OneFirewall can acknowledge the customer as an active contributor. No other information is shared or disclosed without explicit reference to this status.

​
FAQs

Q: How is this information stored in the OneFirewall Data Lake?
A: The JSON information is stored with a randomly generated ID linked to the member, used only to generate anonymous data for updating the Cyber Crime Score. Q: Do other OneFirewall members have access to what I submitted?
A: No. Other members only see the updated Crime Score. Q: If I share information, can I later delete it?
A: Yes. At any point, a member can permanently delete (hard delete) their contributions. Q: Is the handling of this information GDPR compliant?
A: Yes. The shared information contains no PII. Q: Can I stop or pause my contributions?
A: Yes. Data collection/sharing is managed entirely on-premises, so you can pause or stop anytime. Q: Can I choose which cyber events to contribute?
A: Currently, event-level selection is not supported, but a custom pattern can be applied upon request. Q: How often is information contributed to the community?
A: Every 60 seconds (configurable).