---
module: aria.ioc-feeds
title: IOC Feeds
tab: Customer
order: 10
audience: customer
---

Keeps HiveIQ's threat intelligence up to date by pulling the latest known-bad indicators from trusted public sources. Use this screen to check that each feed is healthy and to pull in fresh threats on demand.

## 🛰️ The Feeds
Three threat intelligence sources are tracked:
- **AlienVault OTX** — community-shared threat indicators.
- **MalwareBazaar** — known malware samples and signatures.
- **ThreatFox** — active attack indicators.

## 🔄 What you can do here
1. Click **Run All Feeds** to refresh every feed at once.
2. Click **↻ Run Feed** on any single card to refresh just that source.
3. Click **Refresh** to reload the latest status and history without pulling new data.

> Status updates on its own every 30 seconds while you have the screen open.

## 📇 What each feed card shows
- **Status badge** — Success, Error, Running, or Never run.
- **Configured** vs **API key required** — a feed tagged *API key required* still needs a key before it can run, and its **Run Feed** button stays disabled until then.
- **Last run** — how long ago the feed was pulled.
- **IOCs added** — new indicators brought in on the last run.
- **Updated** — existing indicators refreshed on the last run.

## 📜 Run history
The table below the cards lists every feed run, newest first:
- **Feed** — which source ran.
- **Started** — when the run began.
- **Duration** — how long it took.
- **Status** — the result of that run.
- **Added** / **Updated** — how many indicators were brought in or refreshed.
- **Error** — a short reason if a run failed (hover to read the full message).

> **Good to know:** A run marked *Error* usually points to a feed that still needs an API key or a source that was temporarily unreachable — try running it again, and check the Error column if it keeps failing.
