Integrations

Automated incident response, threat reporting, and blocking

Overview

Flowtriq integrations fire automatically during DDoS incidents. They handle incident response (blocking attacker IPs via local firewall rules or remote firewall APIs), threat intelligence reporting (sharing attacker data with global databases like AbuseIPDB and CrowdSec), and automated blocking via external security platforms. Each integration is configured per workspace and triggers without manual intervention.

iptables

The iptables integration auto-generates DROP rules for attacker IPs identified during a DDoS incident. Rules are pushed directly to the Flowtriq agent running on the node, which applies them to the local firewall.

• Rules are generated when an incident is detected and contain source IPs from the attack traffic
• The auto-apply option pushes rules to the agent immediately without manual confirmation
• When auto-apply is disabled, rules are staged in the dashboard for review before deployment
• Rules are automatically removed when the incident resolves (configurable)

Setup

1. Go to Dashboard → Integrations
2. Click Add Integration and select iptables
3. Choose whether to enable auto-apply (recommended for production nodes with tuned baselines)
4. Save the integration

AbuseIPDB

The AbuseIPDB integration reports attacker IPs to the AbuseIPDB global threat intelligence database when an incident resolves. Reports are filed under category 4 (DDoS Attack) and include the attack type, duration, and peak PPS.

• Up to 20 attacker IPs are reported per incident (AbuseIPDB rate limits apply)
• Reports include structured comments with attack metadata
• Duplicate IPs already reported within the last 15 minutes are skipped automatically
• Requires an AbuseIPDB API key (free tier: 1,000 reports/day)

Setup

1. Create an account at abuseipdb.com and generate an API key
2. Go to Dashboard → Integrations
3. Click Add Integration and select AbuseIPDB
4. Paste your API key and save

CrowdSec

The CrowdSec integration pushes attacker IPs as ban decisions to a CrowdSec LAPI (Local API) instance. When an incident resolves, Flowtriq sends each attacker IP as a ban decision so that CrowdSec bouncers across your infrastructure can block the traffic.

• Ban duration is configurable: 1 hour, 4 hours, 12 hours, 24 hours, 3 days, or 7 days
• Decisions include the attack scenario, origin, and scope for CrowdSec's decision engine
• Requires a CrowdSec bouncer API key (generated with cscli bouncers add flowtriq)
• The LAPI URL must be reachable from Flowtriq's servers (default: http://localhost:8080)
• Fires on incident resolution to ensure only confirmed attacker IPs are banned

Setup

1. Install CrowdSec on your infrastructure and ensure the LAPI is accessible
2. Generate a bouncer API key: sudo cscli bouncers add flowtriq
3. Go to Dashboard → Integrations
4. Click Add Integration and select CrowdSec
5. Enter your LAPI URL and bouncer API key
6. Set the ban duration and save

pfSense / OPNsense Firewall API

The pfSense integration connects to the pfSense REST API to dynamically add attacker IPs to a firewall alias. When an attack is detected, high-confidence attacker IPs are pushed into a configurable alias (default: FlowtriqBlocklist) that you reference in your firewall rules. IPs are automatically removed when the incident resolves.

• Works with pfSense CE (via pfSense-API package) and pfSense Plus (built-in REST API)
• Also works with OPNsense via the OPNsense API (same setup process)
• Creates the alias automatically if it does not exist
• Only high-confidence IPs (above 40% confidence) are added to prevent blocking legitimate traffic
• Supports API v1 and v2 endpoints
• TTL is configurable per-integration (default: 60 minutes)

Setup

1. Install the pfSense-API package (pfSense CE) or enable the REST API (pfSense Plus)
2. Generate an API key or access token in your pfSense admin panel
3. Create a firewall rule that blocks traffic from the alias (Firewall → Rules → add a block rule with source set to the alias)
4. Go to Dashboard → Integrations
5. Click Add Integration and select pfSense
6. Enter your pfSense host URL (e.g. https://192.168.1.1), API key, and alias name
7. Enable auto-apply and save

MikroTik

The MikroTik integration uses the RouterOS REST API to add attacker IPs to a dynamic address list. When an attack is detected, high-confidence source IPs are added to a configurable address list (default: flowtriq-blocklist) with an optional timeout. Reference this list in your firewall filter rules to drop traffic from attackers.

• Requires RouterOS 7.1+ with the REST API enabled (enabled by default on port 443)
• Each entry includes a comment with the incident ID and attack type for audit trails
• Timeout is configurable: entries can expire automatically after 1-168 hours, or persist indefinitely
• Only high-confidence IPs (above 40% confidence) are added automatically
• Duplicate entries for the same IP are skipped automatically

Network Requirements

The Flowtriq dashboard server connects to your MikroTik router directly via the REST API. You should whitelist 139.177.197.144 (Flowtriq production) in your router's firewall so it can reach the management interface. No inbound connections from MikroTik to Flowtriq are required.

HTTP vs HTTPS

Use HTTPS whenever possible. MikroTik v7 supports TLS 1.2, which works with the Flowtriq integration. Enable the www-ssl service and enter https://your-router-ip as the host URL. If you are using a self-signed certificate (the RouterOS default), leave Verify SSL unchecked in the integration settings. HTTP works as a fallback but is not recommended since credentials are sent with each request.

Auto-apply vs Observation Mode

The MikroTik integration supports two modes:

• Auto-apply (enabled): Attacker IPs are pushed to your address list automatically the moment an attack is detected, and removed when the attack ends. No manual intervention needed.
• Observation mode (auto-apply disabled): No automatic blocking. Instead, use the Push to Firewall button on any active incident to manually review and select which attacker IPs to push to your MikroTik. You can block all IPs at once or select individual ones. This gives you full control over what gets blocked.

Setup

1. Ensure RouterOS REST API is accessible (System → IP → Services → www-ssl must be enabled)
2. Create a dedicated API user: /user add name=flowtriq group=full password=YOUR_PASSWORD
3. Create a firewall drop rule that references the address list:
   /ip firewall filter add chain=forward src-address-list=flowtriq-blocklist action=drop comment="Flowtriq DDoS blocklist"
4. Whitelist 139.177.197.144 so the Flowtriq server can reach your router's REST API
5. Go to Dashboard → Integrations
6. Click Add Integration and select MikroTik
7. Enter your MikroTik host URL (e.g. https://192.168.88.1), username, password, and address list name
8. Set the timeout. Enable auto-apply for automatic blocking, or leave it unchecked for observation mode with manual push

Generic Webhook

The generic webhook integration sends structured JSON payloads to any HTTP endpoint when incidents are created, updated, or resolved. Payloads are signed with HMAC-SHA256 so your receiving endpoint can verify authenticity.

• Payloads include incident metadata, attacker IPs, attack classification, peak metrics, and node details
• The X-Flowtriq-Signature header contains the HMAC-SHA256 signature of the request body
• Useful for SIEM integration, custom automation pipelines, Slack bots, ticketing systems, and internal dashboards
• Supports any endpoint that accepts HTTP POST with a JSON body
• Failed deliveries are retried up to 3 times with exponential backoff

Setup

1. Go to Dashboard → Integrations
2. Click Add Integration and select Webhook
3. Enter your endpoint URL
4. Copy the generated signing secret and use it to verify signatures on your end
5. Optionally add custom HTTP headers (e.g., authorization tokens)
6. Save and use the Test button to send a sample payload

Example Payload

Related

• SIEM Integrations - Export attack data to Splunk, Elasticsearch, Microsoft Sentinel, Syslog CEF, Wazuh, MISP, Suricata, and Zeek
• Cloud Scrubbing - Auto-divert traffic to Cloudflare, OVH, Hetzner, AWS Shield, DigitalOcean, Vultr, and Linode
• Alert Channels - Notifications via Discord, Slack, PagerDuty, OpsGenie, Email, SMS, Teams, Telegram, Grafana, Datadog, and Prometheus
• Platform Integrations - Setup guides for pfSense, OPNsense, VyOS, cPanel, Plesk, WHMCS, Pterodactyl, Docker, Proxmox, and cloud providers