building-threat-intelligence-feed-integration

name	building-threat-intelligence-feed-integration
description	Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
domain	cybersecurity
tags	["soc","threat-intelligence","stix","taxii","misp","feeds","ioc","siem-integration"]
subdomain	soc-operations
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Building Threat Intelligence Feed Integration

Overview

Cybersecurity skill for building threat intelligence feed integration. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "building threat intelligence feed integration"
• "SOC teams need automated ingestion of threat intelligence feeds into SIEM platfo"
• "Multiple TI sources require normalization into a common format (STIX 2"
• "Detection systems need real-time IOC matching against network and endpoint telem"

Use this skill when:

• SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms
• Multiple TI sources require normalization into a common format (STIX 2.1)
• Detection systems need real-time IOC matching against network and endpoint telemetry
• TI feed quality assessment and deduplication processes need to be established

Do not use for manual IOC lookup — use dedicated enrichment tools (VirusTotal, AbuseIPDB) for ad-hoc queries.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• MISP instance or Threat Intelligence Platform (TIP) for feed aggregation
• STIX/TAXII client library (taxii2-client, stix2 Python packages)
• SIEM platform (Splunk ES, Elastic Security, or Sentinel) with TI framework configured
• API keys for commercial and open-source feeds (AlienVault OTX, Abuse.ch, CISA AIS)
• Python 3.8+ for feed processing automation

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}