> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abusix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Inbound Processing

## Inbound Processing Explained

**Inbound Processing**, located in the AbuseHQ settings, gives you the power to decide which events reach AbuseHQ and how to enrich those events.

The configurable **Inbound Processing Flow Chart** presents the journey of your events before they enter AbuseHQ.

* The **“Incoming Events”** (input node) is where parsed email and API events enter the inbound processing flow.
* Events are then triaged and tagged with an **event type**.
* Finally, data is sent to **AbuseHQ**, where it is orchestrated.

## ![Abusix Diagram](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F66e526e3-4965-4509-be65-f55f768ec875%2FUntitled-18.jpg?table=block\&id=8cfd0c6c-ebff-4014-90a1-6d07299aabd4\&cache=v2)

## Configuring Inbound Processing

To configure Inbound Processing:

1. Open the **Admin Portal** in AbuseHQ.
2. Click **Settings** in the left-hand menu.
3. Under **Automation**, click **Inbound Processing**.

***

## Default Configuration

The default AbuseHQ Inbound Processing setup includes:

* A **filter** called `IsRecent`
* A **resolver** called `IPResolver`

### Step 1: `IsRecent`

* If an event **matches** the date filter, it proceeds to the `IPResolver`. (Shown by a green arrow in the flow chart.)
* If it **does not match**, the event is **dropped** and not processed further. (This is shown with no link from the “Failed” red output.)

### Step 2: `IPResolver`

* This resolver enriches the event's IP address and adds a **Subscriber ID**.
* The event is then forwarded to **AbuseHQ (AHQ)**.
* Some resolvers can resolve **domain-based reports** (e.g., phishing) to an IP address to help identify the correct subscriber.

![IP Resolver](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F470d5d8a-e163-4d70-9c69-a04b663fe28c%2FUntitled-20.jpg?table=block\&id=1a288849-77c0-41d5-b45c-f27d2cd1dc54\&cache=v2)

***

## API Resolver

Inbound Processing is **fully configurable** and supports API integrations.

For example, you can:

* Query values from your **RADIUS server** or **CRM**
* Customize identification and tagging logic

## ![API Resolver](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F2eb52912-96b0-4ccb-b529-f8ca40ea673b%2FUntitled-19.jpg?table=block\&id=50820a23-8197-45db-b757-c3eb25fb3366\&cache=v2)

## Integrity Checks

Inbound Processing includes **three integrity checks**, displayed in the upper-right of the configuration screen:

1. **No loops** – Ensures there are no circular paths in the flow.
2. **Connection to AHQ** – Verifies that there’s at least one path from the input node to AbuseHQ.
3. **No disconnected nodes** – Detects isolated nodes or subgraphs that can’t be reached.
   ![Integrity Checks](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fc763dd0a-31f8-40b9-8ff6-472959a25a65%2FUntitled-21.jpg?table=block\&id=3e58be7e-d88f-4f56-9169-0c2a37979a50\&cache=v2)

***

## Saving Changes

Changes made in Inbound Processing are **saved**, but **not live immediately**.

Once your configuration is ready:

* Click **Set it Live** to apply it.
* Click **Restore live config** to reset the chart to the current live version.
  ![Restore Live Config](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fc21f2042-a368-4462-963c-641f64173d1b%2FUntitled-22.jpg?table=block\&id=06e0bece-32fc-47f8-97c6-d22199e745a6\&cache=v2)

***

## Filtering Reports Based on Age

You may only want to process reports up to a certain age (e.g., 30 days), based on legal, technical, or organizational policies.

* Use the `IsRecent` filter to accomplish this.
* This filter is included in the **default processing chain**.
  ![Filtering](https://www.abusix.com/wp-content/uploads/2023/12/https3A2F2Fstatic.helpjuice.com2Fhelpjuice_production2Fuploads2Fupload2Fimage2F70252Fdirect2F1596146716407-1596146716407.png)

### Configuration Steps:

1. Click the `IsRecent` node.
2. Fill out the form on the right:
   * Set a **name**, **description**, and the **filter logic**.
   * Example: check if an event's date is newer than `30d`.

Other useful filters might include:

* IP is in a configured network
* IP has a specific network tag
* Event type (e.g., spam, copyright)
* Sender’s email address

***

## Dropping Misdirected Reports

Sometimes, abuse reports are sent to your address for IPs **you do not manage**—these are considered noise.

AbuseHQ’s Inbound Processing can filter out such misdirected reports by comparing them to your defined networks in:

> **Settings > Networks**

This ensures you focus only on events relevant to your infrastructure.
![Misdirected Reports](https://www.abusix.com/wp-content/uploads/2023/12/https3A2F2Fstatic.helpjuice.com2Fhelpjuice_production2Fuploads2Fupload2Fimage2F70252Fdirect2F1596146666329-1596146666329.png)

***