Adding a Custom AI URL Category
to Your Next-Gen Firewall

# FortiOS CLI — Configure external threat feed for AI tool domains

config system external-resource
    edit "AI-Tools-Feed"
        set type category
        set resource "https://feeds.aitoolsblocklist.com/v1/domains?format=plain&key=YOUR_API_KEY"
        set refresh-rate 1440    # Refresh every 1440 minutes (24 hours)
        set status enable
    next
end

# Create a web filter profile that blocks the AI category
config webfilter profile
    edit "Block-AI-Tools"
        config ftgd-wf
            config filters
                edit 1
                    set category 192    # Custom category ID for AI-Tools-Feed
                    set action block
                next
            end
        end
    next
end

# Apply the web filter profile to a firewall policy
config firewall policy
    edit 10
        set name "Block-AI-Outbound"
        set srcintf "internal"
        set dstintf "wan1"
        set action accept
        set utm-status enable
        set webfilter-profile "Block-AI-Tools"
    next
end

#!/usr/bin/env python3
# Automated AI URL category updater — multi-vendor support
# Schedule via cron: 0 3 * * * /opt/scripts/update_ai_category.py

import requests, json, sys, logging
from datetime import datetime, timedelta

logging.basicConfig(level=logging.INFO,
    format='%(asctime)s [%(levelname)s] %(message)s')
log = logging.getLogger('ai-category-updater')

# Configuration
API_KEY    = "YOUR_API_KEY"
FEED_URL   = "https://api.aitoolsblocklist.com/v1/domains"
DELTA_URL  = "https://api.aitoolsblocklist.com/v1/delta"
STATE_FILE = "/var/lib/ai-blocklist/last_sync.json"

def fetch_delta():
    """Fetch only domains changed since last sync."""
    try:
        with open(STATE_FILE) as f:
            state = json.load(f)
        since = state["last_sync"]
    except FileNotFoundError:
        since = (datetime.utcnow() - timedelta(days=30)).isoformat() + "Z"

    resp = requests.get(DELTA_URL,
        params={"since": since, "format": "json"},
        headers={"Authorization": f"Bearer {API_KEY}"},
        timeout=30)
    resp.raise_for_status()
    data = resp.json()

    log.info(f"Delta: {len(data['added'])} added, {len(data['removed'])} removed")
    return data

def update_panos_edl():
    """Force PAN-OS to refresh its EDL immediately."""
    import subprocess
    result = subprocess.run([
        "curl", "-sk",
        "https://firewall.local/api/?type=op&cmd="
        ""
        ""
        "&key=PAN_API_KEY"
    ], capture_output=True)
    log.info(f"PAN-OS EDL refresh: {result.returncode}")

def update_zscaler(added, removed):
    """Push delta to Zscaler custom URL category."""
    session = requests.Session()
    # Authenticate to ZIA API
    session.post("https://zsapi.zscaler.net/api/v1/authenticatedSession",
        json={"apiKey": "ZIA_KEY", "username": "admin", "password": "pass"})
    # Get current category, merge delta, PUT update
    cat = session.get("https://zsapi.zscaler.net/api/v1/urlCategories/CUSTOM_CAT_ID").json()
    urls = set(cat["urls"])
    urls.update(added)
    urls -= set(removed)
    cat["urls"] = list(urls)
    session.put(f"https://zsapi.zscaler.net/api/v1/urlCategories/{cat['id']}", json=cat)
    session.post("https://zsapi.zscaler.net/api/v1/status/activate")
    log.info(f"Zscaler updated: {len(urls)} total domains")

if __name__ == "__main__":
    delta = fetch_delta()
    update_panos_edl()
    update_zscaler(delta["added"], delta["removed"])
    # Save sync state
    with open(STATE_FILE, "w") as f:
        json.dump({"last_sync": delta["timestamp"]}, f)
    log.info("All platforms updated successfully")