Help Fortinet detect emerging threats and unwanted reconnaissance earlier.
ELLIO enriches the Fortinet Security Fabric with real-time attacker infrastructure intelligence, enabling FortiGate, FortiManager, FortiSIEM, and FortiSOAR to make smarter blocking, detection, and investigation decisions with continuously updated IP context and threat relationships.
Extended threat intelligence for Fortinet ecosystem
Block what is attacking now.
FortiGate already blocks known threats using FortiGuard. ELLIO extends this capability with continuously updated intelligence about active attacker infrastructure delivered through External Dynamic Lists (EDL). The result is faster response to emerging attacks, fewer manual updates, less false positives, and blocking policies that adapt as attacker infrastructure changes.
Stop Active Attackers Immediately
ELLIO continuously identifies IPs involved in active scanning, exploitation, brute-force attacks, and other malicious activity. As attacker infrastructure evolves, IPs are automatically added and removed, ensuring FortiGate enforces security policies using live attacker intelligence instead of static reputation.
Reduce False Positives with Always-Current Business Service IP Intelligence
Choose which cloud, SaaS, and scanning services to block or always allow, either broadly or in detail. ELLIO keeps IP ranges updated and applies them automatically where needed.
Reduce Manual Syncing and Operational Effort
Keep IP blocking and allowlisting up to date with the latest threat landscape without manual updates, syncing, or maintenance effort. Create custom blocklists and allowlists, or combine ELLIO intelligence with existing non-ELLIO IP feeds. ELLIO keeps everything continuously updated and automatically applied.
Stop attacks early before they become serious incidents.
ELLIO continuously maps attacker infrastructure behind reconnaissance, brute-force campaigns, mass exploitation, and rapidly changing cloud-hosted attack sources. Instead of reacting to isolated firewall events, Fortinet users gain infrastructure-level visibility that improves blocking decisions, investigation speed, and security automation.
| FortiGuard Intelligence | ELLIO Intelligence | |
|---|---|---|
| protection capabilities | ||
| Primary Focus | Known Malicious Infrastructure | Active Attacker Infrastructure |
| Known Malicious IP | Yes | Yes |
| Currently Active Malicious IPs | Limited | Yes - Core capability |
| Live Reconnaissance IPs | Limited | Yes - Core Capability |
| IPs Involved in Active Mass Exploitation | Limited | Yes - Core Capability |
| SHH Brute-Force Infrastructure | Limited | Yes - Core Capability |
| VPN Attack Source | Limited | Yes - Core Capability |
| Cloud and VPS Abuse | Limited | Yes - Core Capability |
| Behavioral Infrastructure Relationships | - | Yes |
| Infrastructure Clustering | - | Yes |
| Attacker Lifecycle Tracking | - | Yes |
| MANAGING CAPABILITIES | ||
| Delivery | Native FortiGate Services | External Dynamic Lists (EDL) + API |
| Custom Automation | Via Other Tools | Yes |
| Configuration | Via Other Tools | Fully Configurable |
| Customized Blocking and Allowing for Scanners, Cloud, and SaaS Services | - | Yes - Broadly / Granularly |
Understand attacker infrastructure, not just individual IP addresses.
Firewall logs answer what happened. ELLIO explains who is behind it, how the infrastructure is related, whether the activity is still ongoing, and how confident you should be in responding. Enrich your SIEM, SOAR, or TIP with ELLIO Threat Intelligence to reduce alert fatigue, improve automation quality, and investigate incidents faster.
Are these repeated login attempts coming from the same attacker?
Which vulnerabilities are currently being exploited in the wild?
Is this IP part of active scanning or exploitation infrastructure?
Are these FortiGate alerts part of one coordinated attack or separate events?
Is this outbound traffic from internal systems linked to compromise or scanning activity?
Why are we seeing the same attack from different cloud IPs?
Which FortiSIEM alerts should be escalated to incidents first?
Are these VPN or SSH brute-force attempts coming from one attacker or many?
Are these alerts related to active attacker infrastructure or just background internet noise?
Why do new source IPs appear immediately after blocking in FortiGate?
