# Data Sources

Sentinel draws on several publicly available, regularly updated data sources for threat intelligence — keeping it self-hosting friendly rather than depending on a proprietary feed.

| Data source | Used for | Env var |
|---|---|---|
| **FireHOL IP Lists** | Malicious IP identification, feeding [Threat Intelligence](/docs/sentinel/features/threat-intelligence/). | — |
| **PhishTank** (phishtank.org) | URLs for [Phishing Detection](/docs/sentinel/features/phishing-detection/). | `PHISHING_LIST_URL` |
| **disposable-email-domains** project | Detecting throwaway email addresses. | `EMAIL_LIST_DISPOSABLE` |
| **intoli/user-agents** dataset | Identifying suspicious/uncommon user agents. | `USER_AGENT_LIST_URL` |
| **High-risk countries** | 20+ countries flagged for stricter default handling. | `HIGH_RISK_COUNTRIES` |

## Automatic updates

Each source refreshes on its own cron-style schedule — override the relevant `*_SCHEDULE` variable to change the frequency. See [ENV Variables](/docs/sentinel/operations/env-variables/#lists-phishing-disposable-email-user-agents) for the full list of source URLs and schedule variables.

## Related

- **[Threat Intelligence](/docs/sentinel/features/threat-intelligence/)** and **[Phishing Detection](/docs/sentinel/features/phishing-detection/)** — features these sources power.
- **[Security Groups](/docs/sentinel/configure/security-groups/)** — `country` and other rule conditions that use this data, including the `list:high_risk` value.