Linux host agent

Run the CTIF agent on a Linux server to sync the scored feed into nftables, with a list-only mode for evaluation.

Plan needed: Base, SMB, SOC or an active trial
Written against: systemd-based distributions with nftables.

Install

curl -fsSL https://ctif.orvteam.com/agent/install.sh | sudo sh
sudo vi /etc/ctif-agent/agent.conf     # CTIF_API_KEY, MIN_SCORE, MODE
sudo systemctl enable --now ctif-agent.timer

Evaluate before you enforce

Set MODE to list-only first. The agent then downloads and reports what it would block without touching a rule, which is the honest way to find out whether a threshold is right for your traffic before it costs you a customer connection. Switch to enforcing once the list looks sane.

The agent applies a list you chose at a threshold you chose. You remain responsible for what gets blocked on your own network.

If it does not work

Send the exact URL with the key redacted, the UTC time and the response you got to support@orvteam.com. Response targets are on the support page, and current service health is on the status page.