---
module: aria.ioc-feeds
title: IOC Feeds
tab: Testing
order: 35
audience: dev
---

Frontend test checklist for **IOC Feeds** in ARIA (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail.

## Set up
Log in at **aria.bcos.dev** — test accounts (all password `Passw0rd-d3v!`):

| Login | Role | Sees |
|-------|------|------|
| `bcos_a@bcos.dev` | Admin | IOC Feeds — full access |
| `msp_a@msp1.bcos.dev` | MSP admin | IOC Feeds **not** available |
| `customer_a@customer1.bcos.dev` | Customer | IOC Feeds **not** available |

IOC Feeds pulls global threat data (AlienVault OTX, MalwareBazaar, ThreatFox) — it is **not** scoped to institutions or devices, so there is no C1/C2/C3 split here. Access is admin-only.

## What to test

| # | Do this | ✅ Pass if |
|---|---------|-----------|
| 1 | As `bcos_a`, open **IOC Feeds** | Page loads with **three feed cards** — AlienVault OTX, MalwareBazaar, ThreatFox — and a **Run history** table below |
| 2 | Look at each feed card | Each shows a **status badge** (Success / Error / Running / Never run), a **Configured** or **API key required** tag, and **Last run / IOCs added / Updated** stats |
| 3 | Find a card tagged **API key required** | Its **↻ Run Feed** button is **greyed out / disabled** (card has an amber tint) |
| 4 | Click **Run All Feeds** | Button shows **Running…** and a success toast appears; after a few seconds the status and Run history reload |
| 5 | On a **Configured** card, click **↻ Run Feed** | A toast confirms that feed is refreshing; the card badge can move to **Running** then update *(if every card shows "API key required", all single Run buttons are disabled — note it and skip)* |
| 6 | Click **Refresh** (grey button) | Status and history **reload**, but **no new run row** is added to the history |
| 7 | In **Run history**, hover a row's **Error** cell that has text | A tooltip shows the **full error message** (the cell itself may be truncated with …) |
| 8 | Leave the screen open ~30 seconds without clicking | Status **refreshes on its own** (the "Last run" times update) — no manual reload needed |
| 9 | Log in as `msp_a`, then `customer_a`, and look for IOC Feeds | The screen is **not available** to them (not in the menu, or it shows no feed data) — only the admin can use it |

**Report a fail with:** the row #, which login you used, and what you actually saw.
