# Threat feeds

> OpenWAF blocks addresses listed in curated threat-intelligence feeds of known attackers; the feeds are on by default and can be switched off per zone or name.

The edge keeps an up-to-date list of network ranges taken from curated threat-intelligence feeds of known attackers. With `enable_feed` on (the default), a request from a listed address is blocked with a 403 and a security event named `Feed Block`.

- The lists are maintained by OpenWAF and refreshed regularly on every edge node; you don't manage them.
- Entries are checked before they are used: private and reserved ranges and overly broad ranges are never blocked.
- An [IP rule](https://developers.openwaf.dev/waf/ip-and-country-rules/) with action `allow` skips the feeds (and country rules) for that address.
- Feeds apply in every [WAF mode](https://developers.openwaf.dev/waf/modes-and-levels/#modes), including log-only.

## Switch them off

**Dashboard**

Domain → **Security → Firewall → Protection** → **Threat intelligence feeds**. Use **Applies to** to change one name only.
**CLI**

```sh
openwaf-cloud ctl zones set example.com enable_feed=false --reason "Partner network listed by a feed"
```
**API**

```sh
curl -sS -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/edge" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "X-Change-Reason: Partner network listed by a feed" \
  -H "Content-Type: application/json" \
  -d '{"enable_feed": false}'
```
**MCP**

`update_settings` with `"settings": {"enable_feed": false}`.


> **Tip**
>
> If a single partner or office address is listed, add an IP `allow` rule for it instead of switching the feeds off for everyone.