Sophos Firewall can pull third-party threat feeds into its active threat response (ATR): lists of IP addresses, domains and URLs that other people have seen doing harm. On 6 November 2026 I took a snapshot of that page. The first number that caught my eye was the quota, 94% used. Is that a problem, and what does the rest of the screen actually prove?
20 / 30feeds active / configured
1,452,582IPv4 indicators
664,832domains
167,514URLs
2,284,928indicators in total
Feed quota: 94% used · 6% free
- Feed statusOne feed showed an SSL/TLS error when downloading.
- Disabled entries10 of the 30 configured entries were not active.
- Blocked threatsThe table had entries; I keep its rows out of the public page.
- Monitored threatsEmpty.
Public feeds in the list include URLhaus, Feodo Tracker, QFeeds.
The counts, the quota and the four status views are as recorded on that date. The feed names are the public ones in the list; the rows of the blocked-threats table stay out of this page because they would describe traffic from my network.
Four separate questions
A single dashboard mixes answers to four separate questions. I kept getting confused until I wrote them down apart:
- What did I configure? Twenty entries active out of thirty configured. The other ten are switched off, and the screen does not say whether each was a choice or a leftover. That is a configuration question, answered by reading each entry, not by the totals.
- Are the feeds downloading? One feed showed an SSL/TLS error. An entry can be enabled and still not updating, so its indicators may be old or missing. This is a health question, answered by the feed’s last successful update and its certificate chain.
- Is anything being enforced? The blocked-threats table had entries, so ATR matched real traffic and acted on it. The monitored-threats view was empty: nothing was recorded there. Enforcement is the only question here that involves my traffic at all.
- How much do the feeds overlap? The 2,284,928 indicators are the sum of the three types (1,452,582 IPv4 addresses, 664,832 domains and 167,514 URLs). If two feeds list the same address, my reading is that it takes space in both lists. I have not confirmed how Sophos deduplicates, so I treat the total as list entries, not as two million distinct threats.
What the 94% quota measures
94% used sounds like an alarm. Read against the four questions, it is a capacity figure: the lists take up most of the space available for them. It says nothing about whether the feeds are fresh (question 2) or whether they stop anything (question 3). The useful move at 94% is to look for overlap and dead weight, such as a feed that duplicates another or one that has stopped updating, before adding anything new.
Which feed limits and features apply depends on the licence and firmware version, so I check Sophos’s documentation for my version instead of assuming an edition.
An earlier false positive from a feed list
A threat list is only as good as its false positives. In the NOC case, a container could not install updates because the firewall answered NXDOMAIN for a package mirror itself, and disabling one ATR list fixed it. That is question 3 working against me: enforcement on traffic I wanted.
What I learned
One screen held a configuration answer, a health answer, an enforcement answer and a capacity figure, and the number that looked most urgent was the least informative. I now read a security dashboard by first asking which question each number answers, then checking that number’s own evidence.
Takeaway: a full quota is a reason to prune and verify, not proof of protection. The blocked-threats table, a feed’s last good download and the rule that acted are the evidence; the totals are inventory.
Further reading: URLhaus · Feodo Tracker · Sophos documentation
Skills used
- Reading a security dashboard as separate questions
- Telling capacity apart from protection
Tools in this entry
- Sophos Firewall In my lab
Official documentation for Sophos Firewall