Threat intelligence and analysis
Threat Intelligence Feed
A threat intelligence feed is a continuously updated stream of machine-readable indicators, such as malicious domains, URLs, IP addresses and file hashes, that security tools can consume to detect or block known threats.
What a feed contains
At minimum, an indicator and a timestamp. Better feeds add the type of threat, the confidence, the source, the first and last time it was seen, and a link to context. The richer the feed, the more useful it is beyond blocking, because an analyst can tell why an indicator is on the list and whether it still belongs there.
Judging a feed
- Timeliness: how long after an indicator is first observed does it appear?
- Precision: how many entries are stale, benign or shared infrastructure that cannot be blocked?
- Coverage: does it see the threats that matter to this organisation, in its sector and regions?
- Format: can it be consumed without custom parsing? STIX and TAXII exist for this.
- Expiry: does it say when an indicator should be dropped?
Feeds and brand protection
A phishing feed tells a mail gateway what to block. It is less useful to the brand being impersonated, because the brand needs to know about the site whether or not its own users will visit it. Brand-focused monitoring therefore consumes feeds as one input among several and filters them for the brand's own marks rather than for the organisation's own perimeter.
Related terms
Sources
- NIST CSRC glossary: cyber threat intelligence
- NIST SP 800-150: Guide to Cyber Threat Information Sharing
- OASIS STIX 2.1 specification
External guidance is general. Adapt it to your legal, regulatory and operational requirements.