Data Sources
Sentinel draws on several publicly available, regularly updated data sources for threat intelligence — keeping it self-hosting friendly rather than depending on a proprietary feed.
| Data source | Used for | Env var |
|---|---|---|
| FireHOL IP Lists | Malicious IP identification, feeding Threat Intelligence. | — |
| PhishTank (phishtank.org) | URLs for Phishing Detection. | PHISHING_LIST_URL |
| disposable-email-domains project | Detecting throwaway email addresses. | EMAIL_LIST_DISPOSABLE |
| intoli/user-agents dataset | Identifying suspicious/uncommon user agents. | USER_AGENT_LIST_URL |
| High-risk countries | 20+ countries flagged for stricter default handling. | HIGH_RISK_COUNTRIES |
Automatic updates
Each source refreshes on its own cron-style schedule — override the relevant *_SCHEDULE variable to change the frequency. See ENV Variables for the full list of source URLs and schedule variables.
Related
- Threat Intelligence and Phishing Detection — features these sources power.
- Security Groups —
countryand other rule conditions that use this data, including thelist:high_riskvalue.