What a Threat Intelligence Feed Really Is

What a Threat Intelligence Feed Really Is

This lesson defines threat intelligence feeds, explores common record types and source models, and shows why a stream of indicators is evidence for analysis rather than an automatic verdict.

Feed, data, and intelligence are different things

A cyber threat intelligence feed is a recurring delivery mechanism for threat-related records. It may arrive through an API, a TAXII collection, a downloadable file, email, or a platform connector. The feed can contain IP addresses, domains, URLs, file hashes, certificates, vulnerability references, malware labels, sightings, or relationships between threat objects. Its defining feature is repeated delivery, not the quality of its conclusions.

A useful record answers more than “what value was observed?” It identifies the producer, when the value was first and last seen, why it was considered suspicious, how confident the producer is, and how the recipient may share it. Some feeds provide only a value and a category. Others use structured objects to connect an indicator with malware, infrastructure, a campaign, or a defensive course of action.

The feed itself is not finished intelligence for your organization. Intelligence connects evaluated evidence to a decision. A domain associated with phishing elsewhere may be irrelevant to your environment, already remediated, shared by benign tenants, or too old to act on. Analysts create value by testing the record against local telemetry, assets, requirements, and risk tolerance.

A practical record checklist

Before using a record, ask: What is the observable? Who produced it? What evidence supports it? When was it valid? What behavior does it represent? How confident is the source? What handling or licensing rules apply? Which local decision could it change? Missing answers do not always make a record useless, but they limit the actions it can safely support.

Source models and delivery formats

Feed sources differ in how they collect and prepare data. Open community feeds can provide broad, transparent coverage at low cost, but quality and continuity vary. Commercial providers may add proprietary collection, curation, support, service levels, and historical context. Government and sector-sharing communities can supply information relevant to a constituency, often with participation and handling conditions. Internal feeds turn an organization’s confirmed incidents, honeypot observations, and detections into reusable knowledge.

Delivery also matters. A flat text or CSV list is easy to ingest but usually carries little relationship data. JSON APIs can preserve richer fields but may use a vendor-specific schema. STIX is a language and TAXII is an exchange protocol for cyber threat and observable information. They improve interoperability, yet a valid STIX object can still be vague, old, or irrelevant. Standards preserve structure, not truth.

Push delivery reduces delay but requires a receiving service and careful retry handling. Pull delivery is simpler to control, though polling intervals create latency. Full snapshots simplify recovery while forcing consumers to detect changes. Incremental collections reduce volume but require cursor, timestamp, deletion, and replay logic. Select the mechanism based on the decision’s time horizon and the team’s ability to operate it reliably.

A source portfolio usually works better than a single “best” feed. Different sources may cover malware, phishing, scanning infrastructure, vulnerabilities, or a particular region. Diversity adds value only when provenance survives aggregation. If ten downstream lists copy the same original observation, they are one piece of evidence, not ten independent confirmations.

The indicator lifecycle and its limits

Indicators decay. An attacker can abandon a domain, rotate an IP address, rebuild a file, or move behind shared cloud infrastructure. Some observables remain useful for months; others last minutes. A static “malicious” label hides this lifecycle. Feed processing should preserve first-seen and last-seen times, record local sightings, and apply an expiry policy that reflects indicator type and behavior.

False positives often come from context collapse. A shared hosting IP may serve one malicious tenant and hundreds of legitimate services. A dual-use administration tool may appear during both intrusion and authorized maintenance. A file hash offers strong identity for that exact file but misses modified samples. A domain can move from malicious control to a legitimate new owner. These are reasons to choose proportional actions, not reasons to discard feeds.

Use low-context records for reversible tasks such as enrichment, retrospective search, or hunt leads. Require stronger provenance, recent observations, corroboration, and impact review before automated prevention. Preserve a path for an analyst to see why a score or action occurred. A feed program is healthy when it helps the team ask better questions and act faster without hiding uncertainty.

The next module turns this mental model into a selection and integration workflow. The central principle remains the same: the intended decision determines the evidence, speed, context, and confidence you need.

Resources

• OASIS STIX Version 2.1 — Use the official standard to understand how cyber threat and observable information can be represented, related, and exchanged.
• OASIS STIX and TAXII standards overview — Read this official overview for the distinct roles of the STIX representation and TAXII transport protocol.