Features
Automatic Updates Without Manual List Maintenance
How firewalls retrieve Cybora feeds regularly, and why polling intervals must fit the plan, platform, and operational goal.
Last updated: June 26, 2026
On this page
Cybora feeds are not maintained manually as CSV files. The firewall retrieves the feed URL regularly over HTTPS and updates its internal list according to the platform’s capabilities. This allows new or removed indicators to take effect without constant manual maintenance.
This pull approach fits firewalls well because the platform itself decides when it loads external lists, stores them, and uses them in policies.
Why polling matters
Attacker infrastructure rotates. New sources appear, old ones disappear, compromised systems are cleaned up, and domains change their role. A feed therefore needs regular updates.
At the same time, more frequent polling does not automatically mean fresher data. If a plan updates every six hours, retrieving the feed every minute only creates load and can trigger protection mechanisms.
What admins should configure
The polling interval should consider three things:
- update frequency of the Cybora plan
- technical capabilities and recommendations of the firewall
- desired balance of freshness, load, and stability
The firewall should retrieve the feed roughly in line with the plan or follow the vendor recommendations. Excessive polling does not provide additional security value.
Operations and failure patterns
Typical problems include rate limits, timeouts, certificate errors, incorrect feed URLs, mismatched indicator types, or lists that are not fully loaded by the firewall. Details are documented in Polling Intervals and Updates and Validation and Troubleshooting.
Key rotation and plan changes
When a license key is replaced, the feed URL on the firewall must be updated accordingly. During rotation, the new retrieval should be verified deliberately: HTTP status, list content, timestamp of the last import, and policy reference should line up.
When a plan changes, update frequency and feed scope can change. The firewall continues polling on its own schedule, but receives the currently authorized feed on the next successful retrieval. Admins should therefore check after a plan change whether polling interval, platform limits, and desired feed types still make sense.