Settings

Unsaved changes

API Credentials

GTI

Client ID ?

GTI Client ID
The unique identifier for your GTI API application. This is provided when you register your application in the GTI developer portal.

Client Secret ?

GTI Client Secret
The secret key for authenticating with the GTI API. Keep this secure and never share it publicly.

CrowdStrike

Client ID ?

CrowdStrike Client ID
The API client ID for your CrowdStrike Falcon instance. Found in your Falcon dashboard under API Management.

Client Secret ?

CrowdStrike Client Secret
The secret key for CrowdStrike API authentication. Treat this like a password and keep it secure.

Feed Settings

IOC Types ?

IOC Type Selection
Choose which types of indicators of compromise to fetch from GTI. Each type has different data characteristics and use cases:

IP: Malicious IP addresses
SHA256: File hashes
URL: Malicious URLs
Domain: Malicious domains

Default Pull Days ?

Historical Data Range
Number of days of historical IOC data to fetch when not specified per type. Typical values: 7-30 days.

Page Limit ?

API Pagination Limit
Maximum number of pages to fetch per IOC type. Set to 0 for unlimited (not recommended for large datasets).

Pull Days: IP ?

IP Historical Range
Number of days of historical IP address data to fetch. IPs change frequently, so shorter periods are typical.

Pull Days: SHA256 ?

File Hash Historical Range
Number of days of historical SHA256 hash data to fetch. File hashes have longer lifespans than IPs.

Pull Days: URL ?

URL Historical Range
Number of days of historical URL data to fetch. Malicious URLs may be taken down quickly.

Pull Days: Domain ?

Domain Historical Range
Number of days of historical domain data to fetch. Domains may persist longer than individual URLs.

Page Timeout (s) ?

Request Timeout
Maximum time in seconds to wait for each API page request. Increase for slow connections, decrease for faster failures.

Max Pages/Type ?

Per-Type Page Limit
Maximum pages to fetch for each IOC type. Overrides global page limit. Set to 0 for unlimited.

0 = unlimited

Only fetch report-backed IOCs ?

Report-Backed Only
When enabled, only fetch IOCs that have supporting threat intelligence reports. This reduces volume but increases data quality and reliability.

Reset Watermarks (Force Full Refetch) ?

Watermark Reset
Enable this to ignore the "last seen" timestamps and perform a full fetch from the source. Useful if you changed pull windows or suspect missing data. (Will reset to off after the next run)

Retry Configuration

Max Retry Attempts ?

Maximum Retry Attempts
Number of times to retry failed API requests before giving up. Recommended: 3-5 for production, 2-3 for testing.

Base Delay (seconds) ?

Base Retry Delay
Initial delay between retry attempts. Will be multiplied by backoff factor for subsequent retries.

Max Delay (seconds) ?

Maximum Retry Delay
Upper limit for retry delays to prevent excessive wait times.

Backoff Multiplier ?

Exponential Backoff Factor
Multiplier applied to delay for each retry attempt. 2.0 = standard exponential backoff (1s, 2s, 4s, 8s...)

Retry Strategy ?

Retry Strategy
Exponential: Delay increases exponentially (recommended)
Linear: Delay increases linearly
Fixed: Same delay for all retries
Jitter: Exponential with random variation

Enable Jitter ?

Random Jitter
Add random variation to retry delays to prevent thundering herd problems when multiple requests fail simultaneously.

Confidence Filter

Min Confidence ?

Confidence Threshold (Min)
Minimum confidence score (0-100) for IOCs to be processed. Higher values filter out less reliable indicators.

Max Confidence ?

Confidence Threshold (Max)
Maximum confidence score (0-100) for IOCs to be processed. Useful for excluding extremely high-confidence false positives.

CrowdStrike

Region ?

CrowdStrike Region
Geographic region for your CrowdStrike Falcon instance. Must match your organization's region configuration.

Repository ?

IOC Repository
Target repository name in CrowdStrike for IOC uploads (Legacy LogScale only). Leave default unless using custom repository configuration.

Upload Version ?

CrowdStrike API Version
Next-Gen SIEM: Modern API for NG-SIEM lookup files (recommended)
Legacy LogScale: Original API for LogScale file uploads

Export & CSV

Export Mode ?

CSV Export Format
By Type: Separate CSV file for each IOC type
Combined: All IOCs in single CSV file
Both: Generate both formats

CSV Size Limit (MB) ?

File Size Limit
Maximum file size for individual CSV files. Larger files are split to prevent upload issues.

CSV Row Limit ?

Row Count Limit
Maximum number of rows per CSV file. Set to 0 for unlimited. Helps manage large datasets.

0 = unlimited

Export Date Range Filter ?

Date Range Filter
Limit which IOCs appear in exported CSV files based on when they were first seen or created.

Leave both dates empty to export all active IOCs (default behavior). Set only "from" to export everything after a date. Set only "to" to export everything before a date.

Export From

Only export IOCs seen/created after this date

Export To

Only export IOCs seen/created before this date

Filter By Field ?

Date Field Selection
first_seen: When the IOC was first observed in the feed (recommended)
create_time: When the IOC was originally created in GTI

Active filter:

TTL & Lifecycle

TTL: IP (days) ?

Time To Live - IP Addresses
Number of days to retain IP indicators in the local database. After this period, IPs are automatically removed unless updated.

TTL: SHA256 (days) ?

Time To Live - File Hashes
Number of days to retain SHA256 file hashes. File hashes typically have longer retention periods than IPs.

TTL: URL (days) ?

URL Retention Period
Number of days to retain malicious URLs. URLs may become inactive quickly, so shorter TTLs are common.

TTL: Domain (days) ?

Domain Retention Period
Number of days to retain malicious domains. Domains typically remain active longer than individual URLs.

Removal Grace Cycles ?

Grace Period
Number of pipeline runs to keep expired IOCs before removal. Allows time for manual review of expiring indicators.

Audit Retention (days) ?

Audit Log Retention
Number of days to keep pipeline execution logs. Longer retention helps with troubleshooting and compliance.

Anomaly Drop Threshold (%) ?

Anomaly Detection
Percentage drop in IOC count that triggers anomaly detection. Helps identify data quality issues or API problems.

Hash Resolution

Drop unresolved MD5/SHA1 hashes ?

Hash Resolution Filter
When enabled, remove MD5/SHA1 hashes that cannot be resolved to SHA256. This improves data quality but reduces volume.

Concurrency ?

Resolution Concurrency
Number of hash resolution requests to process simultaneously. Higher values speed up processing but may hit API limits.

Cache TTL (days) ?

Hash Cache Duration
Number of days to cache hash resolution results. Reduces API calls and improves performance for repeated hashes.

Scheduler

Interval (hours) ?

Schedule Frequency
Hours between automatic pipeline runs. Use 0.5 for 30-minute intervals. Set to 0 to disable scheduler.

Jitter (seconds) ?

Random Delay
Random delay added to scheduled runs to prevent synchronized requests across multiple instances.

Failure Cooldown (s) ?

Failure Recovery Delay
Seconds to wait after a failed run before retrying. Prevents rapid repeated failures and API rate limiting.

Max Consecutive Failures ?

Failure Threshold
Maximum consecutive failures before scheduler stops. Prevents endless retry loops on persistent issues.

Advanced

Checkpoint TTL (hours) ?

Checkpoint Expiration
Hours to keep pipeline checkpoint data. Old checkpoints are automatically cleaned up.

Log File Path ?

Custom Log Location
Optional custom file path for pipeline logs. Leave empty for default location.

JSON log format ?

Structured Logging
When enabled, logs are written in JSON format for better integration with log analysis tools.

Data Directory ?

Storage Location
Directory for storing database, cache, and other data files. Must be writable by the application.