# Turn on threat lists, and investigate a flagged connection

> Turn on FireAI’s opt-in public threat lists on your Mac, then read the full dossier behind anything they flag before deciding.

FireAI Docs (HisnLabs) · Tutorial · Available since FireAI 0.1.0
Canonical: https://hisnlabs.com/fireai/en/docs/turn-on-threat-lists-and-investigate

**Where in FireAI:** Threats

Go from a red flag to a real answer in one page, without leaving FireAI.

## Turn the lists on

1. Open Threats and find “Where the threat data comes from”.
2. Turn on Use public threat data. FireAI downloads the public lists once a day; your traffic is never sent to them.
3. Optionally turn on Block what a threat list confirms so a confirmed match is blocked outright, not just shown.

## Read a flagged connection

1. A finding on the Threats page shows the app, the destination, and a plain reason such as being listed by more than one feed.
2. Click Investigate for the full dossier: a risk score out of 100 with the individual signs that raised or lowered it, what FireAI actually saw (first seen, last seen, apps involved), and — from the unencrypted parts of the connection only, never decrypted HTTPS — the server name, protocol and anything sent in the clear.
3. Open Details for the network owner, whether the address is a known open proxy or Tor exit, and exactly which threat lists were checked and what each one said.
4. If the on-device AI is ready, Summarise the evidence writes three plain sentences from those same facts. FireAI says plainly: it can be wrong — check the sources.

## Decide

Every dossier ends with the same three choices: Block for every app, Block only for this app, or It’s fine. “Look it up yourself” links open your browser for outside sources; FireAI sends nothing to them.

> **Note:** A single hosting-provider IP or an unusual country on its own rarely reaches a high score — it takes several signs agreeing before FireAI calls something worth a look. See [the Threats page](https://hisnlabs.com/fireai/en/docs/the-threats-page) for where flagged connections show up first.

## Read next

- [Threat lists (opt-in)](https://hisnlabs.com/fireai/en/docs/threat-intelligence-feeds.md)
- [Find out where an app sends data, on the World map](https://hisnlabs.com/fireai/en/docs/find-where-an-app-sends-data-on-the-world-map.md)
- ["Why block this?": what a destination usually sends, and why people block it](https://hisnlabs.com/fireai/en/docs/why-block-this.md)

---

Try every feature free for 17 days, no card needed. 30-day money-back guarantee. [Download for Mac](https://hisnlabs.com/fireai/en/download)