As software continues to eat the world, and AI becomes a force multiplier for attackers, those of us tasked with defending our systems have to be more focused, deliberate, and proactive in our approaches. We have to rise up to meet this onslaught of new cyber threats.In this article, we’ll look atthreat intelligence, what it is and why it’s important, how threat intelligence feeds can help us in our daily defense, and how we can create custom threat intelligence feeds that match our organizations’ specific needs. threat intelligence threat intelligence feeds custom threat intelligence feeds Understanding Threat Intelligence Threat intelligence is all the contextual information we need about potential or active cybersecurity threats to help us understand risks. These pieces of information are called threat intelligence indicators. Examples include malicious IPs, domains, malware hashes, and attacker tactics. Threat intelligence threat intelligence indicators Threat intelligence is critical—it helps organizations detect, prevent, and respond to threats by enriching the raw security data with indicators and behavioral patterns. The most effective threat intelligence combines technical information with insights about the threat actors’ goals, methods, and infrastructure. Threat intelligence is crucial for battling alert fatigue and noise. Too much information creates desensitization. We end up responding slowly to, or even ignoring, critical issues. The goal with threat intelligence is to make it meaningful so that we never miss an important alert. There are several types of threat intelligence indicators. Let’s look at each along with its scope and purpose. Threat Intelligence Indicators and Feeds Threat intelligence indicators are often grouped into categories, such as atomic (single pieces of information), computed (information derived from analysis), and behavioral (what the attacker is doing). We also often group the information into feeds—data streams of threat intelligence indicators that we use to feed our systems ongoing updates about risks and threats. That’s what we’ll focus on here. feeds Threat intelligence feeds can be: Strategic feeds - high-level threat trends, emerging risks, and evolving attack vectors, helping with long-term planning and resource prioritization.
Operational feeds - active threats, monitoring the tactics, techniques, and procedures (TTPs) used by adversaries, enabling SOC teams to anticipate and defend against attacks.
Technical feeds - precise, actionable data (such as IP addresses, domains, and malware hashes) that can be used immediately to block known threats.
Tactical feeds - real-time threat data that supports rapid incident response, allowing SOCs to react quickly. Strategic feeds - high-level threat trends, emerging risks, and evolving attack vectors, helping with long-term planning and resource prioritization. Strategic feeds Operational feeds - active threats, monitoring the tactics, techniques, and procedures (TTPs) used by adversaries, enabling SOC teams to anticipate and defend against attacks. Operational feeds Technical feeds - precise, actionable data (such as IP addresses, domains, and malware hashes) that can be used immediately to block known threats. Technical feeds Tactical feeds - real-time threat data that supports rapid incident response, allowing SOCs to react quickly. Tactical feeds Luckily, you don’t have to build all of these feeds from scratch. Commercial vendors, government agencies, and open-source communities provide pre-built threat intelligence feeds in standard formats such as STIX 2.1 (JSON), OpenloC (XML), and MISP (JSON). These feeds vary in scope, quality, and specialization. Some focus on nation-state actors and advanced persistent threats (APTs), while others emphasize malware campaigns, botnets, or phishing infrastructure. Security teams can choose to aggregate multiple feeds to build a comprehensive threat picture appropriate for their organization’s needs. Examples include: AlienVault OTX - a collaborative threat intelligence platform where security professionals share and consume real-time indicators of compromise (IOCs). It provides access to community-curated threat data, including IPs, domains, malware hashes, and attack patterns.
FBI InfraGard - a partnership between the FBI and the private sector focused on protecting critical infrastructure through trusted information sharing. InfraGard provides private threat intelligence alerts and sector-specific feeds derived from FBI investigations and partnerships with infrastructure operators.
Google Threat Intelligence (previously Mandiant) - delivers high-confidence IOCs, malware signatures, YARA rules, actor profiles, and campaign telemetry. Feeds are accessible via API, STIX/TAXII, and integrations with SIEM/SOAR platforms for automated detection and correlation. AlienVault OTX - a collaborative threat intelligence platform where security professionals share and consume real-time indicators of compromise (IOCs). It provides access to community-curated threat data, including IPs, domains, malware hashes, and attack patterns. AlienVault OTX FBI InfraGard - a partnership between the FBI and the private sector focused on protecting critical infrastructure through trusted information sharing. InfraGard provides private threat intelligence alerts and sector-specific feeds derived from FBI investigations and partnerships with infrastructure operators. FBI InfraGard Google Threat Intelligence (previously Mandiant) - delivers high-confidence IOCs, malware signatures, YARA rules, actor profiles, and campaign telemetry. Feeds are accessible via API, STIX/TAXII, and integrations with SIEM/SOAR platforms for automated detection and correlation. Google Threat Intelligence (previously Mandiant) Private Threat Intelligence Feeds But what if these feeds don’t give you everything you need? In that case, you need to BYOF! (Bring your own feed.) Private threat intelligence feeds can be created based on your proprietary organizational needs and added to your threat intelligence systems just like industry feeds. Private threat intelligence feeds Ideally these private feeds are generated by sifting through your (potentially massive amount of) alerts and events, then intelligently surfacing the most relevant indicators. Once you have created your private feed, you can combine it with the standard threat intelligence feeds above. This creates a customized view of threats that allows your security team to zero in and respond to threats quickly. But creating these private feeds can be a challenge. You need to build a system that can store, aggregate, analyze, and combine industry feeds with your private feeds as well as display the information to the security team and integrate with other common tools, all while keeping the system reliable, scalable, and secure. Most organizations prefer to leverage a solid existing platform and focus their resources on their core competencies. Let’s look at one way this can be done. For our example, we’ll use Sumo Logic—a cloud-based log management and analytic service most people are familiar with. Sumo Logic How to Bring Your Own Feeds to Sumo Logic With Sumo Logic, we can use both existing industry feeds and our own custom feeds. Let’s look at how to add both industry and private feeds through the web UI. Set Up the Permissions First, if you haven’t already, go to the administration menu and create a new role with the threat intel capabilities. Navigate to Threat Intelligence Configuration Now go to the Configuration menu. In the Logs section, click Threat Intelligence. Configuration Logs Threat Intelligence You can also just browse directly to https://service.sumologic.com/threat-intelligence. https://service.sumologic.com/threat-intelligence Pre-Built Feeds Pre-Built Feeds You’ll see right away that Sumo Logic already provides pre-built global threat intelligence feeds: Intel471 and CrowdStrike. Intel471 CrowdStrike Intel471 provides threat intelligence focused on adversary behavior gathered from sources like the dark web and criminal forums. Its feed includes actor profiles, early warnings about planned attacks, malware and exploit kit tracking, and context-rich indicators of compromise (IOCs) tied to specific threat actors.
CrowdStrike delivers intelligence derived from real-time endpoint and cloud telemetry collected via its Falcon platform. It includes high-confidence IOCs, adversary attribution, and detailed insight into tactics, techniques, and procedures (TTPs) observed during live attacks, often mapped to the MITRE ATT&CK framework. Intel471 provides threat intelligence focused on adversary behavior gathered from sources like the dark web and criminal forums. Its feed includes actor profiles, early warnings about planned attacks, malware and exploit kit tracking, and context-rich indicators of compromise (IOCs) tied to specific threat actors. Intel471 CrowdStrike delivers intelligence derived from real-time endpoint and cloud telemetry collected via its Falcon platform. It includes high-confidence IOCs, adversary attribution, and detailed insight into tactics, techniques, and procedures (TTPs) observed during live attacks, often mapped to the MITRE ATT&CK framework. CrowdStrike MITRE ATT&CK Together, these feeds give you a great start with a complementary view of the threat landscape: Intel471 focused on attacker intent and planning, and CrowdStrike on active execution and observed campaigns. Intel471 CrowdStrike Adding a New Custom Indicator (BYOF) But we don’t want to just use the pre-built feeds. We want to add our own custom indicator (and eventually feed). So let’s do that next. There are three supported formats: Normalized JSON format
CSV format
STIX 2.x JSON format (API use only) Normalized JSON format Normalized JSON format CSV format CSV format STIX 2.x JSON format (API use only) STIX 2.x JSON format We’ll use JSON. Here’s an example: {
 "indicators": [
   {
     "id": "0001",
     "indicator": "192.0.2.0",
     "type": "ipv4-addr",
     "source": "TAXII2Source",
     "validFrom": "2023-03-21T12:00:00.000Z",
     "validUntil": "2025-03-21T12:00:00.000Z",
     "confidence": 30,
     "threatType": "malicious-activity",
     "actors": "actor1,actor2",
     "killChain": "reconnaissance",
     "fields": {
       "kill_chain_name": "lockheed-martin-cyber-kill-chain",
       "kill_chain_phase": "reconnaissance"
     }
   },
   {
     "id": "0002",
     "indicator": "192.0.2.1",
     "type": "ipv4-addr",
     "source": "TAXII2Source",
     "validFrom": "2023-03-21T12:00:00.000Z",
     "validUntil": "2025-03-21T12:00:00.000Z",
     "confidence": 30,
     "threatType": "malicious-activity",
     "actors": "actor3,actor4",
     "killChain": "reconnaissance",
     "fields": {
       "kill_chain_name": "lockheed-martin-cyber-kill-chain",
       "kill_chain_phase": "reconnaissance"
     }
   }
 ]
} {
 "indicators": [
   {
     "id": "0001",
     "indicator": "192.0.2.0",
     "type": "ipv4-addr",
     "source": "TAXII2Source",
     "validFrom": "2023-03-21T12:00:00.000Z",
     "validUntil": "2025-03-21T12:00:00.000Z",
     "confidence": 30,
     "threatType": "malicious-activity",
     "actors": "actor1,actor2",
     "killChain": "reconnaissance",
     "fields": {
       "kill_chain_name": "lockheed-martin-cyber-kill-chain",
       "kill_chain_phase": "reconnaissance"
     }
   },
   {
     "id": "0002",
     "indicator": "192.0.2.1",
     "type": "ipv4-addr",
     "source": "TAXII2Source",
     "validFrom": "2023-03-21T12:00:00.000Z",
     "validUntil": "2025-03-21T12:00:00.000Z",
     "confidence": 30,
     "threatType": "malicious-activity",
     "actors": "actor3,actor4",
     "killChain": "reconnaissance",
     "fields": {
       "kill_chain_name": "lockheed-martin-cyber-kill-chain",
       "kill_chain_phase": "reconnaissance"
     }
   }
 ]
} See the Threat Intelligence Indicators documentation from Sumo Logic for more details. Threat Intelligence Indicators Custom indicators will show up after a few minutes. Updating Indicators As you may have noticed, this isn’t a dynamic feed that Sumo Logic can query and refresh. Instead, we created a feed that needs periodically updated with the latest threat intelligence. dynamic Why a push-based model? This is quite common and allows Sumo Logic to maintain secure boundaries (no storage of credentials, no webhook/API at risk for attacks) and remove any reliability risks tied to external systems. This also ensures that ingestion is deliberate, standardized, and under the organization’s control. Build Your Own Feed With the above, we can now build our own private threat intelligence feed and combine it with the industry feeds above, creating a customized feed that meets our organization’s exact needs. Building your own feed requires a plan and careful execution. Here are some questions your plan should address: What threat indicators do you want to expose to Sumo Logic?
Do you expose a single indicator or multiple indicators?
How do you collect the relevant information from your system?
How do you filter and prepare the data?
How often do you upload/update indicators? What threat indicators do you want to expose to Sumo Logic? Do you expose a single indicator or multiple indicators? How do you collect the relevant information from your system? How do you filter and prepare the data? How often do you upload/update indicators? For example, let’s say we have a periodic scan of our S3 buckets to ensure they are not public. But some S3 buckets contain public assets that should have public read access. A smart private feed can compare the list of public buckets against a whitelist and upload only the public buckets not in the list. Once you have your answers (and indicators), you build a service that collects, filters, and uploads the indicator files to the Sumo Logic API at regular intervals (or when urgent threats are detected). Sumo Logic will combine this feed with the other selected industry feeds for a customized set of indicators for your organization. API Conclusion Integrating threat intelligence into your security operations is essential for staying ahead of rapidly evolving cyber threats. By leveraging both public and private threat intelligence feeds, we can gain a better understanding of the threat landscape. And ultimately, we can take faster, more precise action. Have a really great day!

The code in this story is for educational purposes. The readers are solely responsible for whatever they build with it.

Arweave

AI Makes Developers Faster. It Also Makes Architecture Worse.

The 4 Big Reasons You’ll Regret Not Moving to E2G Sooner

I ♥ writing code. Find me on GitLab.

Nominated for 2022 - HackerNoon Contributor of the Year - Javascript

Nominated for 2022 - Hackernoons Tech Storyteller of the Year

Nominated for 2022 - HackerNoon Contributor of the Year - Cloud Computing

Nominated for 2022 - HackerNoon Contributor of the Year - Heroku

Nominated for 2022 - HackerNoon Contributor of the Year - Design

Nominated for 2022 - HackerNoon Contributor of the Year - Salesforce

Too Long; Didn't Read

Custom Threat Feeds Are the Future — Here’s How to Get Started

Custom Threat Feeds Are the Future — Here’s How to Get Started

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

5 Signs You’ve Built a Secretly Bad Architecture (And How to Fix It)

'Tis the Season to Secure: How CVEs Are the Grinch for Cybersecurity

44 Stories To Learn About Logging

5 Key Takeaways from New Relic’s 2022 State of Logs Report

A Brief Introduction to Commit Logs

Building A Log Analytics Solution 10 Times More Cost-Effective Than Elasticsearch

5 Signs You’ve Built a Secretly Bad Architecture (And How to Fix It)

'Tis the Season to Secure: How CVEs Are the Grinch for Cybersecurity

44 Stories To Learn About Logging

5 Key Takeaways from New Relic’s 2022 State of Logs Report

A Brief Introduction to Commit Logs

Building A Log Analytics Solution 10 Times More Cost-Effective Than Elasticsearch

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps