Threat Engine

A blocklist is only useful if it is enforced consistently — including behind the NAT that Docker and K3s put in front of your workloads. Threat Engine is our autonomous threat-intelligence daemon: it keeps IP blocklists current and applies them at the kernel level, so known-bad traffic is dropped before it reaches your application stack.

Why teams choose Threat Engine

Most organizations subscribe to threat feeds but have no consistent way to make them bite — especially in containerized environments, where the node's IP tables do not automatically apply to traffic transiting Docker and K3s networks. Threat Engine closes that gap with one daemon that owns the whole path from feed to enforced drop. Operations teams get a predictable, observable enforcement layer: they can see exactly what the lists contain, what would be dropped, and what is being dropped, all through the same Prometheus pipeline they already alert on.

Capabilities

• Continuous feed ingestion — continuously ingests and deduplicates threat feeds and maintains live IP blocklists.
• Kernel-level enforcement — entries land in an ipset applied by an iptables raw:PREROUTING rule, so drops happen in the netfilter raw table and work correctly behind NAT.
• Safe rollout — enforcement is off by default; run in observe mode, watch what it would drop, then switch it on.
• Observable by design — every list change, drop count and feed-health signal is exported as Prometheus metrics, so you can alert on threat-list drift.

How it works

Threat Engine runs as a daemon and continuously ingests configured threat feeds, deduplicating entries as they arrive. The resulting IP blocklist is maintained in an ipset and applied by an iptables rule in the netfilter raw:PREROUTING table — the earliest point in the kernel's packet path, which is precisely what makes the drops effective for traffic moving through Docker and K3s NAT. Before you enable enforcement, you run the same pipeline in observe mode: the daemon reports what it would drop, so you validate against your own traffic and then flip enforcement on with confidence.

Deployment and operations

One daemon, no service to babysit. Every signal — list size, drop counters, feed health — is exported as a Prometheus metric, so Threat Engine slots into your existing dashboards and alerting without a new monitoring stack. Because enforcement is off by default, adoption is a measured rollout: observe, verify, enforce — per host, at your own pace.

Threat Engine is the enforcement layer that pairs with the detection capabilities of our DDoS protection; talk to us about a combined setup through our contact page.