Threat Intel Scrany (TIS)

TIS collects threat-intelligence indicators (IPv4/IPv6 addresses and networks, domain names, URLs) from public and commercial feeds, keeps them in Postgres, and serves them as ready-to-use blocklists for firewalls, routers and DNS resolvers (BIND/Unbound RPZ, zone files, hosts files).

It is operated through a web GUI at /app, an interactive CLI (in the browser via ttyd at /cli) and a token-secured REST API (browsable at /api). Client machines pull their blocklists with tis-pull.sh from cron.

How it works

flowchart LR
    feeds["Threat feeds<br/>(plain, hosts, JSON, CSV)"] -->|scheduled fetch| worker
    push["tis-push.sh / POST /import"] -->|push| api
    admin["Admin<br/>(CLI at /cli, API)"] --> api
    subgraph tis-worker
        worker["Scheduler + Fetcher"]
        api["REST API :3000"]
    end
    worker --> db[("Postgres<br/>tis-db")]
    api --> db
    api <--> cache[("Redis<br/>tis-cache")]
    worker <-.->|schedule resync| cache
    api -->|/cli proxy| cli["tis-cli<br/>(ttyd + CLI)"]
    cli --> db
    clients["Customer machines<br/>tis-pull.sh"] -->|GET /export...| api

• Sources describe where indicators come from: a feed fetched on a schedule, an import-only source fed by tis-push.sh, or a hand-curated manual source.
• Indicators are stored per source, normalised (CIDRs split into address + netmask, domains lowercased) and expire when a feed stops listing them, unless they are permanent.
• Groups bundle sources with their own whitelist and blacklist, so a customer's machines pull one group instead of a list of source IDs.
• Exports merge and deduplicate indicators in the requested format, applying whitelists.
• Tokens authenticate API clients; roles and ACL patterns decide what each token can reach.

Where to go next

I want to…	Page
install or upgrade TIS	Installation & Deployment
change settings (retention, Redis, OIDC, …)	Configuration
add a feed or a manual blocklist	Sources, Indicators
serve one customer several sources at once	Groups
understand the output formats and whitelisting	Export
give someone API access	Tokens & ACL
call the API	API Reference
manage everything in the browser	Web GUI
look up a CLI command	CLI Reference
deploy blocklists to a server with cron	Client Scripts
work on the code	Development

Glossary

Term	Meaning
Indicator	One blockable value: ipv4, ipv6 (with netmask), fqdn, url or json.
Source	Origin of indicators; unique name (slug). Feed, import-only or manual.
Private source	Excluded from the public export; reachable only through per-source, multi-source or group exports.
Permanent indicator	Never removed by retention pruning.
Group	Named set of sources + group whitelist/blacklist, exported together.
Whitelist	Values never exported (IPs/CIDRs, domain globs such as *.example.com).
Blacklist	Values a group always exports, on top of its sources.
Pruning	Daily job soft-deleting indicators not seen for daysRetention days.
RPZ	DNS Response Policy Zone – a zone file BIND/Unbound use to block names.
TID	Threat Intel Daemon – the worker process (scheduler + API).