Threat-intel feeds are lists of known-bad IP addresses (from public reputation sources) that PortWall programs as kernel firewall drop rules, so hostile traffic is refused before it costs any inspection.
Enabling feeds
- Go to Threat-intel Feeds.
- Turn the subsystem on.
- Enable one or more feeds and set each to block.
Within a refresh cycle the worker downloads the feed, subtracts your allowlist, and programs firewall drop rules. The Overview card then shows evidence: e.g. "enforcing 76 firewall rules from 1,711 feed entries."
"Enabled but no firewall rules" — what it means
If the card is red — "enabled with N entries to block, but ZERO firewall rules are programmed" — the feeds are on but not actually blocking anything. PortWall catches this automatically. Common causes and fixes:
- A bad entry in a feed — one malformed address used to abort the whole apply. Recent builds drop the bad entry and program the rest, so this self-heals; if you see it persist, check the worker log for
Threat-intel refresh pass failed. - Licence inactive — enforcement is withheld while unlicensed (detection continues). The Licensing card is the headline; re-activate the licence.
- Backend — reputation enforcement requires the Windows Firewall backend on the host.
The fix text on the card always names the next step.
What's counted as evidence
- feeds — how many feeds are enabled.
- entries — total addresses across the enabled feeds.
- firewall rules — the drop rules actually programmed. Zero-while-enabled-with-entries is the red state.
Herd immunity (the fabric)
If you run more than one PortWall and enrol them in the fabric, confirmed attackers seen by the fleet are shared and programmed as a separate set of firewall rules. A blank herd aggregate can be correct by design — it needs corroboration from independent installations (quorum) before it programs anything. The Herd Immunity page shows configured / enrolled / entitled / last-consume state.
Allowlist always wins
Any address on your allowlist is subtracted from every feed before rules are programmed, so you can never block yourself or a partner with a feed.
Premium Threat Intelligence
On a Premium or Enterprise licence (every appliance licence is Premium or higher), the Feeds page also carries Premium Threat Intelligence: a list PortWall curates from the attacks seen across the PortWall network, with a policy per category and an explanation for every listed address. It is separate from the feeds above and has its own firewall rules. See Premium Threat Intelligence.