Home
Threat Intelligence
Learn how Threat Intelligence quickly detects threats to OT/IoT systems and defends against cyberattacks.
Configuration
Details on how to configure Threat Intelligence.
Sensor-level contents management
By default, Threat Intelligence contents can only be managed on the top-level sensor. However, this policy can be customized to allow any sensor in the solution to add, edit, enable or disable individual contents.

Threat Intelligence
Learn how Threat Intelligence quickly detects threats to OT/IoT systems and defends against cyberattacks.
- Introduction
  An overview of Threat Intelligence.
- Requirements
  A description of the requirements that are necessary to install and use Threat Intelligence.
- Configuration
  Details on how to configure Threat Intelligence.
  - Configure a Threat Intelligence license
    Before you can use the Threat Intelligence, you must install a license.
  - Enable automatic updates
    If you are connected to Vantage, or a Central Management Console (CMC), you can enable automatic Threat Intelligence updates.
  - Configure manual updates
    If your sensor, or Central Management Console (CMC), is not connected to the internet, you can update Threat Intelligence manually.
  - Sensor-level contents management
    By default, Threat Intelligence contents can only be managed on the top-level sensor. However, this policy can be customized to allow any sensor in the solution to add, edit, enable or disable individual contents.
  - Manage contents at sensor level
    You can change the status of the Enable local contents toggle to change how the Threat Intelligence contents are managed.
  - Threat Intelligence Feed
- Maintenance
  Information on how to maintain Threat Intelligence.
- Print format documentation
  A list of all the print-format documentation that is available for Threat Intelligence.

Sensor-level contents management

By default, Threat Intelligence contents can only be managed on the top-level sensor. However, this policy can be customized to allow any sensor in the solution to add, edit, enable or disable individual contents.

When the local management of Threat Intelligence (TI) contents is enabled, each sensor in the solution will allow the user to enable or disable any contents, and to define, edit and remove local contents. In this situation, any additions or changes performed on a Central Management Console (CMC) will not be propagated to the connected sensors.

When the local management of TI contents is disabled, each sensor in the solution will reflect exactly the contents defined on the top-level sensor. In this situation, any content added on the top sensor will be propagated to all connected sensors, and any content enabled or disabled will also be in the same state on all sensors. This also means that, when disabling the local management of contents, all custom contents created on the connected sensors will be erased.