About Air Gapped Data Sync

Air Gapped Data Sync (AGDS) is the supported mechanism for transferring threat intelligence data from a source ThreatQ instance to a target ThreatQ instance deployed in an air-gapped environment. An air-gapped system is defined as one with no connectivity to public networks, meaning external feed ingestion and direct integrations do not occur.

AGDS operates as a two-stage process: data is first exported from the source system using the threatq:sync-export command, which packages selected intelligence objects, related context, metadata, and optional investigations into a portable archive, and is then imported into the air-gapped target system using the threatq:sync-import command.

AGDS supports controlled synchronization of selected content between environments, including updates to object names and descriptions and removals of relationships, attributes, tags, and sources, while preserving data integrity, provenance, and repeatable, auditable synchronization workflows.

ThreatQuotient strongly recommends contacting ThreatQ Support or a Threat Intelligence Engineer prior to implementing AGDS in production environments.