Is it possible to ingest IP addresses and domains names from a third party threat intelligence feed?

[AndreC10002]

It is not clear to me where the "bad" IPs, domains and email addresses come from on Tirreno. Is it possible to ingest IP addresses and domains names from a third party threat intelligence feed?

[arina-tirreno]

@AndreC10002

Could you provide more details about the type of information you'd like to pass into tirreno and how you expect it to be processed on the dashboard?

By default, there is no such concept as a "bad" IP address in tirreno. You can configure rules, for example, to lower the score for users connecting via VPNs or the TOR network.

However, we do not treat a "bad IP" as an ultimate red flag. Here are some explanations: https://www.tirreno.com/bat/?post=2025-05-25

[AndreC10002]

OK, the term "bad" was probably misleading. What I mean to do is import into Tirreno lists of IPs and domains that are potentially malicious (bots, for example). The list could include a score, so Tirreno can process them appropriately.
I understand that the system already uses Tor exit nodes and VPN nodes updated somehow from somewhere. I guess I am asking how to do a similar thing for other indicators (again, bot IPs for example).
Thank you.

[arina-tirreno]

@AndreC10002

Thanks for clarification. tirreno does not provide integration with third party tools to import IP intelligence. What we check if IP is datacenter, VPN, TOR, Apple relay, Starlink, shared IP between different users, if IP is within spam lists, and if it was previously blacklisted by your tirreno.

[AndreC10002]

OK, but where the spam lists come from?

[arina-tirreno]

@AndreC10002

A spam list is a collection of compromised or infected IP addresses compiled from trusted sources. Currently, there is no option to influence which addresses appear on this list.

[AndreC10002]

Got it. So, can we convert this into a feature request. Would like to be able to regularly and automatically have lists of IPs and domains pulled from external sources. There are so many trustworthy and professionally curated sources, it'd be great to be able to draw from them.
Simple scheduled HTTP(S)+auth requests would be enough.
Thank you.

[arina-tirreno]

@AndreC10002

Thanks for the suggestion. We've noted this as a feature request. While there are no immediate plans to implement it, we'll monitor interest from other active tirreno users. If it gains traction, we'll definitely consider it for future development.