How reputation works
What gets scored, how a verdict is reached, and why nothing blocks on the request path.
Threat feeds
The ThreatFeed entity — sources, formats, refresh, and what happens when one fails.
Feed catalog
Curated sources, ready to enable — and what the catalog deliberately does not do.
CrowdSec
Consuming decisions from a Local API, and reporting detections back as alerts.
ASN classification
Resolving a caller to its network, and what that is worth — which is less than it looks.
Geolocation
Where an address is, from a MaxMind DB file each node downloads — for @geoLookup and for the consoles.
DNS blocklists
@rbl in WAF rules — asked asynchronously, cached, and never allowed to block anyone by failing.
Reputation plugins
Configuring the route plugin and the global validator.