Loads the threat intelligence data synchronized with the control node in the data node. This command is available only in the data node.


node-feed name=FEED_ID
Required Parameters

Identifier of the threat intelligence feed to query for synchronization. The name=FEED_ID and type=TYPE options cannot be used at the same time. Use either one.

See the following table for available identifiers.

otxipReal-time IP address reputation feed in the format of OTX (Open Threat Exchange)
toripTor exit node IP address information feed
mdl_domaindomainMalicious domain name (e.g. C&C domain) feed
mdl_ipipMalicious domain name (e.g. C&C IP address) feed
abusechdomainMalicious domain name (e.g. C&C domain) feed provided by
malc0demd5Malware database provided by


  1. Look up OTX feeds synchronized in the data node.

    node-feed name=otx
  2. Look up malware IP lists synchronized in the data node.

    node-feed name=mdl_ip