analyzing-threat-intelligence-feeds

# Analyzing Threat Intelligence Feeds ## When to Use Use this skill when: - Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio - Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema - Evaluating feed freshness, fidelity, and relevance to the organization's threat profile - Building automated enrichment pipelines that correlate IOCs against SIEM events **Do not use** this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline. ## Prerequisites - Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI - API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise) - TAXII 2.1 client library (taxii2-client Python package or equivalent) - Role with read/write permissions to the TIP's indicator database ## Workflow ### Step 1: Enumerate and Prioritize Feed Sources List all available feeds categorized by type (commercial, government, ISAC, OSINT): - Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence - Government: CISA AIS (Automated Indicator Sharing), FBI InfraGard, MS-ISAC - OSINT: AlienVault OTX, Abuse.ch, PhishTank, Emerging Threats Score each feed on: update frequency, historical accuracy rate, coverage of your sector, and attribution depth. Use a weighted scoring matrix with criteria from NIST SP 800-150 (Guide to Cyber Threat Information ...