diff --git a/backend/src/main/java/com/park/utmstack/domain/shared_types/enums/SectionType.java b/backend/src/main/java/com/park/utmstack/domain/shared_types/enums/SectionType.java
index 820176c14..29fe3a75a 100644
--- a/backend/src/main/java/com/park/utmstack/domain/shared_types/enums/SectionType.java
+++ b/backend/src/main/java/com/park/utmstack/domain/shared_types/enums/SectionType.java
@@ -10,7 +10,7 @@ public enum SectionType {
     SYSTEM_LICENSE,
     INSTANCE_UPDATE_FREQUENCY,
     INSTANCE_ENABLE_SEND_LOGS,
-    THREATWINDS_CREDENTIALS
+    THREAT_INTELLIGENCE
 
 
 }
diff --git a/backend/src/main/java/com/park/utmstack/service/UtmConfigurationParameterService.java b/backend/src/main/java/com/park/utmstack/service/UtmConfigurationParameterService.java
index 49dd9aca6..bd9810b21 100644
--- a/backend/src/main/java/com/park/utmstack/service/UtmConfigurationParameterService.java
+++ b/backend/src/main/java/com/park/utmstack/service/UtmConfigurationParameterService.java
@@ -5,6 +5,7 @@
 import com.park.utmstack.domain.application_events.enums.ApplicationEventType;
 import com.park.utmstack.domain.tfa.TfaMethod;
 import com.park.utmstack.repository.UtmConfigurationParameterRepository;
+import com.park.utmstack.security.SecurityUtils;
 import com.park.utmstack.service.application_events.ApplicationEventService;
 import com.park.utmstack.service.tfa.TfaService;
 import com.park.utmstack.util.CipherUtil;
@@ -20,6 +21,7 @@
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.StringUtils;
 
+import java.time.Instant;
 import java.util.*;
 import java.util.stream.Collectors;
 
@@ -102,6 +104,8 @@ public void saveAll(List<UtmConfigurationParameter> params) throws UtmMailExcept
 
             Map<String, String> cfg = new HashMap<>();
             List<UtmConfigurationParameter> toSave = new ArrayList<>();
+            Instant now = Instant.now();
+            String user = SecurityUtils.getCurrentUserLogin().orElse(Constants.SYSTEM_ACCOUNT);
             for (UtmConfigurationParameter p : params) {
                 boolean isPassword = Constants.CONF_TYPE_PASSWORD.equalsIgnoreCase(p.getConfParamDatatype());
                 if (isPassword && Constants.MASKED_VALUE.equals(p.getConfParamValue())) {
@@ -110,6 +114,8 @@ public void saveAll(List<UtmConfigurationParameter> params) throws UtmMailExcept
                 cfg.put(p.getConfParamShort(), p.getConfParamValue());
                 if (StringUtils.hasText(p.getConfParamValue()) && isPassword)
                     p.setConfParamValue(CipherUtil.encrypt(p.getConfParamValue(), System.getenv(Constants.ENV_ENCRYPTION_KEY)));
+                p.setModificationTime(now);
+                p.setModificationUser(user);
                 toSave.add(p);
             }
             configParamRepository.saveAll(toSave);
diff --git a/backend/src/main/java/com/park/utmstack/service/validators/tw_config/TwConfigValidatorService.java b/backend/src/main/java/com/park/utmstack/service/validators/tw_config/TwConfigValidatorService.java
deleted file mode 100644
index 6feef35c7..000000000
--- a/backend/src/main/java/com/park/utmstack/service/validators/tw_config/TwConfigValidatorService.java
+++ /dev/null
@@ -1,43 +0,0 @@
-package com.park.utmstack.service.validators.tw_config;
-
-import com.park.utmstack.domain.UtmConfigurationParameter;
-import com.park.utmstack.service.app_info.AppInfoService;
-import lombok.RequiredArgsConstructor;
-import org.springframework.stereotype.Service;
-import org.springframework.validation.Errors;
-import org.springframework.validation.Validator;
-
-@Service
-@RequiredArgsConstructor
-public class TwConfigValidatorService implements Validator {
-
-    private final AppInfoService infoService;
-
-    @Override
-    public boolean supports(Class<?> clazz) {
-        return UtmConfigurationParameter.class.equals(clazz);
-    }
-
-    @Override
-    public void validate(Object target, Errors errors) {
-        UtmConfigurationParameter parameter = (UtmConfigurationParameter) target;
-
-        String value = parameter.getConfParamValue();
-        if (value == null) {
-            errors.rejectValue("confParamValue", "null", "Value cannot be null");
-            return;
-        }
-
-        String edition;
-        try {
-            edition = infoService.loadVersionInfo().getEdition();
-        } catch (Exception e) {
-            errors.reject("appInfo.error", "Could not determine application edition");
-            return;
-        }
-
-        if (!Boolean.parseBoolean(value) && "community".equals(edition)) {
-            errors.rejectValue("confParamValue", "forbidden", "Forbidden to disable in COMMUNITY edition");
-        }
-    }
-}
diff --git a/backend/src/main/java/com/park/utmstack/web/rest/UtmConfigurationParameterResource.java b/backend/src/main/java/com/park/utmstack/web/rest/UtmConfigurationParameterResource.java
index 0e0668104..5853a3ec2 100644
--- a/backend/src/main/java/com/park/utmstack/web/rest/UtmConfigurationParameterResource.java
+++ b/backend/src/main/java/com/park/utmstack/web/rest/UtmConfigurationParameterResource.java
@@ -10,7 +10,6 @@
 import com.park.utmstack.service.dto.UtmConfigurationParameterCriteria;
 import com.park.utmstack.service.mail_config.MailConfigService;
 import com.park.utmstack.service.validators.email.EmailValidatorService;
-import com.park.utmstack.service.validators.tw_config.TwConfigValidatorService;
 import com.park.utmstack.util.ResponseUtil;
 import com.park.utmstack.util.exceptions.UtmMailException;
 import com.park.utmstack.web.rest.util.PaginationUtil;
@@ -52,7 +51,6 @@ public class UtmConfigurationParameterResource {
     private final EmailValidatorService emailValidatorService;
     private final MailConfigService mailConfigService;
     private final UtmStackService utmStackService;
-    private final TwConfigValidatorService twConfigValidatorService;
 
     /**
      * PUT  /utm-configuration-parameters : Updates an existing utmConfigurationParameter.
@@ -70,10 +68,6 @@ public ResponseEntity<Void> updateConfigurationParameters(@Valid @RequestBody Li
             for (UtmConfigurationParameter parameter : parameters) {
                 Errors errors = new BeanPropertyBindingResult(parameter, "utmConfigurationParameter");
 
-                if(parameter.getConfParamShort().equals("utmstack.tw.enable")){
-                    twConfigValidatorService.validate(parameter, errors);
-                }
-
                 if(StringUtils.hasText(parameter.getConfParamRegexp())){
                     emailValidatorService.validate(parameter, errors);
                 }
diff --git a/backend/src/main/resources/config/liquibase/changelog/20260910001_cleanup_threatwinds_params.xml b/backend/src/main/resources/config/liquibase/changelog/20260910001_cleanup_threatwinds_params.xml
new file mode 100644
index 000000000..d4cce9d37
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260910001_cleanup_threatwinds_params.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
+
+    <changeSet id="20260910001" author="Alex">
+
+        <delete tableName="utm_configuration_parameter">
+            <where>id IN (40, 41)</where>
+        </delete>
+
+        <update tableName="utm_configuration_section">
+            <column name="section" value="Threat Intelligence"/>
+            <column name="description" value="Threat Intelligence integration settings."/>
+            <column name="short_name" value="THREAT_INTELLIGENCE"/>
+            <where>id = 10</where>
+        </update>
+
+    </changeSet>
+</databaseChangeLog>
diff --git a/backend/src/main/resources/config/liquibase/master.xml b/backend/src/main/resources/config/liquibase/master.xml
index 506b2b9f4..e629d8868 100644
--- a/backend/src/main/resources/config/liquibase/master.xml
+++ b/backend/src/main/resources/config/liquibase/master.xml
@@ -604,5 +604,7 @@
   <include file="/config/liquibase/changelog/20260623001_migrate_compliance_report_config_to_control_config.xml" relativeToChangelogFile="false"/>
     
   <include file="/config/liquibase/changelog/20260831001_update_login_failed_menu_event_code.xml" relativeToChangelogFile="false"/>
-    
+
+  <include file="/config/liquibase/changelog/20260910001_cleanup_threatwinds_params.xml" relativeToChangelogFile="false"/>
+
 </databaseChangeLog>
diff --git a/frontend/src/app/shared/components/utm/config/app-config-sections/app-config-sections.component.html b/frontend/src/app/shared/components/utm/config/app-config-sections/app-config-sections.component.html
index bc3288290..d48caf357 100644
--- a/frontend/src/app/shared/components/utm/config/app-config-sections/app-config-sections.component.html
+++ b/frontend/src/app/shared/components/utm/config/app-config-sections/app-config-sections.component.html
@@ -48,7 +48,7 @@ <h6 class="font-weight-semibold mb-2">{{section.section | titlecase}}</h6>
   <div *ngIf="configs.length >0 && !loading" class="d-flex gap-3 flex-wrap w-100">
     <ng-container *ngFor="let conf of getConfigs()">
       <div [ngClass]="conf.confParamDatatype === configDataTypeEnum.List || conf.confParamDatatype === configDataTypeEnum.EmailList || conf.confParamDatatype === ConfigDataTypeEnum.Cron ? 'w-100 order-8':'w-30'"
-           class="form-group mb-4" *ngIf="(conf.confParamShort !== 'utmstack.tw.enable') || (conf.confParamShort === 'utmstack.tw.enable' && versionType === VERSION_TYPE.ENTERPRISE)">
+           class="form-group mb-4">
         <label [for]="'sectionParam'+conf.id"
                class="pb-1 span-small-icon d-flex justify-content-between align-items-center">
       <span>
diff --git a/plugins/config/go.mod b/plugins/config/go.mod
index 63980d00c..19c68303b 100644
--- a/plugins/config/go.mod
+++ b/plugins/config/go.mod
@@ -5,6 +5,7 @@ go 1.25.5
 require (
 	github.com/lib/pq v1.12.3
 	github.com/threatwinds/go-sdk v1.1.31
+	google.golang.org/protobuf v1.36.12
 	gopkg.in/yaml.v3 v3.0.1
 	sigs.k8s.io/yaml v1.6.0
 )
@@ -54,5 +55,4 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/grpc v1.83.2 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
 )
diff --git a/plugins/config/go.sum b/plugins/config/go.sum
index 5f35c15ee..4a75feecb 100644
--- a/plugins/config/go.sum
+++ b/plugins/config/go.sum
@@ -148,8 +148,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
 google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/plugins/config/main.go b/plugins/config/main.go
index 5d596d59f..67f9c77ea 100644
--- a/plugins/config/main.go
+++ b/plugins/config/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -14,6 +15,7 @@ import (
 	"github.com/threatwinds/go-sdk/utils"
 
 	_ "github.com/lib/pq"
+	"google.golang.org/protobuf/types/known/structpb"
 	"gopkg.in/yaml.v3"
 	k8syaml "sigs.k8s.io/yaml"
 )
@@ -82,6 +84,8 @@ type ConfigState struct {
 	FiltersCount       int
 	PatternsLastUpdate time.Time
 	PatternsCount      int
+	TwEnableLastUpdate time.Time
+	TwEnableCount      int
 }
 
 func (b *ExpressionBackend) ToExpression() Expression {
@@ -423,6 +427,20 @@ func main() {
 				return
 			}
 
+			enabled, err := getTwEnableConfig(db)
+			if err != nil {
+				_ = catcher.Error("failed to get feeds toggle", err, map[string]any{"process": "plugin_com.utmstack.config"})
+				time.Sleep(30 * time.Second)
+				return
+			}
+
+			err = writeFeedsConfig(enabled)
+			if err != nil {
+				_ = catcher.Error("failed to write feeds config", err, map[string]any{"process": "plugin_com.utmstack.config"})
+				time.Sleep(30 * time.Second)
+				return
+			}
+
 			*state = newState
 		}()
 
@@ -446,6 +464,7 @@ func hasChanges(db *sql.DB, state *ConfigState) (bool, ConfigState, error) {
 		{"SELECT MAX(rule_last_update) FROM utm_correlation_rules", "SELECT COUNT(*) FROM utm_correlation_rules WHERE rule_active = true", &newState.RulesLastUpdate, &newState.RulesCount, state.RulesLastUpdate, state.RulesCount},
 		{"SELECT MAX(updated_at) FROM utm_logstash_filter", "SELECT COUNT(*) FROM utm_logstash_filter WHERE is_active = true", &newState.FiltersLastUpdate, &newState.FiltersCount, state.FiltersLastUpdate, state.FiltersCount},
 		{"SELECT MAX(last_update) FROM utm_regex_pattern", "SELECT COUNT(*) FROM utm_regex_pattern", &newState.PatternsLastUpdate, &newState.PatternsCount, state.PatternsLastUpdate, state.PatternsCount},
+		{"SELECT MAX(modification_time) FROM utm_configuration_parameter WHERE conf_param_short = 'utmstack.tw.enable'", "SELECT COUNT(*) FROM utm_configuration_parameter WHERE conf_param_short = 'utmstack.tw.enable'", &newState.TwEnableLastUpdate, &newState.TwEnableCount, state.TwEnableLastUpdate, state.TwEnableCount},
 	}
 
 	for _, q := range queries {
@@ -915,3 +934,64 @@ func writePatterns(patterns map[string]string) error {
 
 	return nil
 }
+
+func getTwEnableConfig(db *sql.DB) (bool, error) {
+	var value string
+	err := db.QueryRow(`SELECT conf_param_value FROM utm_configuration_parameter WHERE conf_param_short = 'utmstack.tw.enable' LIMIT 1`).Scan(&value)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return true, nil
+		}
+		return true, catcher.Error("failed to fetch utmstack.tw.enable", err, map[string]any{"process": "plugin_com.utmstack.config"})
+	}
+	enabled, parseErr := strconv.ParseBool(value)
+	if parseErr != nil {
+		catcher.Warn("failed to parse utmstack.tw.enable value; defaulting to enabled", map[string]any{
+			"value":   value,
+			"error":   parseErr.Error(),
+			"process": "plugin_com.utmstack.config",
+		})
+		return true, nil
+	}
+	return enabled, nil
+}
+
+func writeFeedsConfig(enabled bool) error {
+	filePath, err := utils.MkdirJoin(plugins.WorkDir, "pipeline")
+	if err != nil {
+		return catcher.Error("cannot create pipeline directory", err, nil)
+	}
+
+	file, err := os.Create(filePath.FileJoin("system_plugins_feeds.yaml"))
+	if err != nil {
+		return catcher.Error("failed to create file", err, map[string]any{"process": "plugin_com.utmstack.config"})
+	}
+
+	defer func() {
+		if err := file.Close(); err != nil {
+			_ = catcher.Error("failed to close file", err, map[string]any{"process": "plugin_com.utmstack.config"})
+		}
+	}()
+
+	feedsStruct, err := structpb.NewStruct(map[string]any{"enabled": enabled})
+	if err != nil {
+		return catcher.Error("failed to build feeds struct", err, map[string]any{"process": "plugin_com.utmstack.config"})
+	}
+
+	config := plugins.Config{
+		Plugins: map[string]*structpb.Value{
+			"feeds": structpb.NewStructValue(feedsStruct),
+		},
+	}
+
+	bytes, err := k8syaml.Marshal(config)
+	if err != nil {
+		return catcher.Error("failed to marshal feeds config", err, map[string]any{"process": "plugin_com.utmstack.config"})
+	}
+
+	if _, err := file.Write(bytes); err != nil {
+		return catcher.Error("failed to write to file", err, map[string]any{"process": "plugin_com.utmstack.config"})
+	}
+
+	return nil
+}