Threat intelligence

Goal

Enrich decisions with IP reputation from threat-intel providers.

Steps

1. Load a threat-intel plugin (sample static feed).
2. Open Security → Threat intel.
3. Create a provider (interval, feed path/URL, fail-closed flag).
4. Trigger sync or wait for Worker ThreatIntelSyncHostedService.
5. Write policies using { "inspector": "threatIntel" }.
6. Provider enable/fail-closed changes auto-publish snapshot settings.

Runtime

Proxy looks up client IP in the reputation store. Store errors: fail-closed → hit, else miss. Exact IP match is the MVP (CIDR deferred for runtime hits).

Verify

• Sync succeeds; indicators visible in the UI.
• Matching client IP triggers inspector hit and your policy action.