| name | analyzing-threat-intelligence-feeds |
| description | Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
|
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["STIX","TAXII","MITRE-ATT&CK","IOC","ThreatConnect","Recorded-Future","MISP","CTI","NIST-CSF"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
Analyzing Threat Intelligence Feeds
When to Use
Use this skill when:
- Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio
- Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema
- Evaluating feed freshness, fidelity, and relevance to the organization's threat profile
- Building automated enrichment pipelines that correlate IOCs against SIEM events
Do not use this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline.
Detection Gaps & Validation
- Feed staleness & churn: IPs/domains rotate fast; ingesting without TTLs (IP 30d, domain 90d, hash 1y) turns yesterday's true positives into today's false positives. Enforce expiry at ingest, not at block time.
- Dedup failures: the same IOC from five feeds must collapse on a normalized
value+type composite key -- without it, SIEM rule counts and confidence aggregation inflate. Normalize case, strip ports/paths, and refang before hashing the key.
- STIX 2.1 mapping errors: malformed patterns (
[ipv4-addr:value = '...'] vs network-traffic), wrong hashes.SHA-256 casing, and missing confidence/valid_from cause silent drops on TAXII push. Validate objects against the OASIS schema.
- Confidence flattening: mapping every source to confidence 100 destroys triage; calibrate per feed fidelity from true-positive history.
To validate: push a sample bundle through TAXII 2.1 to a staging collection and confirm the consumer (Splunk/Sentinel) ingests the indicators with correct types and TTLs; run a known-overlapping IOC through two feeds and confirm dedup yields one object. Spot-check that confidence <50 routes to detection-only (not blocking) and that TLP:RED content is never exported past authorized collections.
Prerequisites
- Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI
- API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise)
- TAXII 2.1 client library (taxii2-client Python package or equivalent)
- Role with read/write permissions to the TIP's indicator database
Workflow
Step 1: Enumerate and Prioritize Feed Sources
List all available feeds categorized by type (commercial, government, ISAC, OSINT):
- Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence
