Threat intelligence
Admin > Trust Engine > Threat intelligence is where you connect the sources a policy's restrictions read, and where you see whether each one is answering. Country and known networks are answered by Knocknoc itself and need nothing here.
Location
IP location database is the database Knocknoc ships with, which places an address in a country. There is nothing to connect, and the card shows when it was built. Update your server to get newer data. If it reads Not loaded, the country restriction has nothing to place an address with and lets every address through.
Realtime location sources
IPinfo and Spur answer the residential proxy, VPN provider and Tor exit node restrictions, and each can also place an address in a country. One is enough. With both connected, a finding from either is a match, and one of them failing does not stop the other deciding.
Where the address is can only come from one source. Make primary on a card decides which one's country and network name is used when the two disagree. What either source finds still counts.
Paste a key into a card to connect it. The key is checked with the provider as part of the save: one the provider rejects, or one on a plan without the data the restrictions read, is refused with the reason. If the provider cannot be reached to check, the key saves and the card reads Not verified yet until its first use.
Known malicious sources
GreyNoise answers the malicious address restriction. Beside it sit your own blocked address lists, which need no key and work on their own. Either one is enough for the restriction to run. See Blocked Address Lists for the list format, the fetch schedule and what a list card says.
What a card says
| Status | Meaning |
| Working | The last call was answered. |
| Not verified yet | A key is saved but nothing has used it. |
| Key rejected | The provider refused the key. |
| Last call failed | The key is accepted but the most recent call did not get an answer. |
| Degraded | Knocknoc is restoring the service. Stored answers are used until then. |
| Not connected | No key. Restrictions that need this source are not evaluated. |
| Disabled | The key is kept but nothing asks the source. |
| Paid plan | Your plan does not include this source. |
When a source stops answering
The card says why the last call failed and what fixes it: the key was refused, the key's plan does not include the data Knocknoc reads, the account has used its queries for the billing cycle, the provider is limiting requests, the provider returned an error, the call timed out, or this server could not connect at all.
Check now asks the provider again with the key in use and updates the card straight away, rather than waiting for the next sign-in or the six-hourly check. Each check is one call and counts against the provider's quota.
What happens to access meanwhile is the attached policy's If a data source cannot answer setting.
A key that comes with your license
Your Knocknoc license can carry a provider key. When it does and you have saved no key of your own, the card reads Working with nothing to edit, says the key is provided by Knocknoc, and offers Use your own key. A key you saved yourself stays in charge until you remove it; the card then offers Use license-provided key, which removes yours and bills usage to Knocknoc rather than your own account.
If a later license fetch stops providing a key you were running on, the card and the banner at the top of the admin pages say so until you connect your own or dismiss the notice.
Clear cached answers
An answer about an address is reused for up to 12 hours, so a second sign-in from the same address inside that window costs no lookup. Clear cached answers drops every stored answer on every server, so the next sign-in from each address asks again. It says how many this server dropped; the other servers follow on their next sync.
On a free plan
Country is the one restriction a free plan can run, answered by the bundled database. No key on this page is in use, and the page says so.