node-feed

Queries threat intelligence feed data downloaded to the Data Node through the policy synchronization module.

Command properties

Property	Description
Command type	Driver
Required permission	Administrator
License usage	Not counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

node-feed [name=STR] [type={URL|DOMAIN|EMAIL|IP|REGISTRY|MD5|SHA1|SHA256}]

Options

name=STR: Threat intelligence feed name. You must specify either name or type.
type={URL|DOMAIN|EMAIL|IP|REGISTRY|MD5|SHA1|SHA256}: Threat intelligence feed type. You must specify either name or type.

URL: URL
DOMAIN: Domain
EMAIL: Email
IP: IP address
REGISTRY: Registry
MD5: MD5 hash
SHA1: SHA1 hash
SHA256: SHA256 hash

Output fields

Field	Type	Description
`_time`	timestamp	Time the feed entry was registered
`feed_name`	string	Threat intelligence feed name
Feed type key	string	Value according to feed type (e.g., `ip`, `domain`, `url`, `md5`, etc.)

Error codes

Parse errors

Error code	Message	Description
300340	no permission for node-feed	Executed from a session without administrator privileges.
300341	`name` or `type` option is required for node-feed	Both the `name` and `type` options were omitted.
300342	feed [name] not found for node-feed	A non-existent feed name was specified for the `name` option.
300343	feed [type] not found for node-feed	An invalid type was specified for the `type` option.
300344	feed matcher not found for node-feed	Feed matcher initialization failed.

Runtime errors

None

Description

The node-feed command queries threat intelligence feed data deployed to the Data Node from the Control Node through policy synchronization. Use the name option to query data for a specific feed, or the type option to query all feed data of a specific type.

This command runs on the Data Node, so it is used to verify the status of feed data synchronized to the Data Node.

Examples

Query data for a specific feed name
```
node-feed name=malware_ip
```
Queries all entries registered in the malware_ip feed.
Query data by feed type
```
node-feed type=IP
```
Queries all threat intelligence feed data of IP type.
Query domain type feed data
```
node-feed type=DOMAIN
```
Queries all threat intelligence feed data of DOMAIN type.