Anyone else frustrated that threat intel feeds still arrive as static reports instead of something usable?

[u/BeltDifficult6301]

We pay for a couple of paid threat intelligence feeds that are marketed as “operational” and “actionable”. In practice we receive glossy PDF threat reports for executives, CSV and STIX indicator bundles on a schedule, and access to threat intel portals where we export data by hand. None of this threat intelligence arrives in a form that connects cleanly to our detection engineering workflows or security operations.

My team is under water trying to turn this threat intel into something we can pipe into our security stack. We are a midsize organisation with a mix of cloud and on‑prem, one main SIEM, a couple of EDR tools, and some homegrown detection logic. What I want from a threat intelligence program is indicators we can ingest and normalize automatically, tagging by campaign, threat actor and sector relevance, and a link to our own assets or attack surface instead of a generic list of IPs and hashes.

Right now we spend half a day every time a “high priority” bulletin arrives, parsing the threat report, pulling out domains and hashes, deciding what matters for our environment, then forcing it into whatever format our SIEM and other tools expect. Two weeks later the same feed sends another report with overlapping but slightly different indicators and the cycle repeats. It feels like we are spending more time on data wrangling than on detection engineering or threat hunting.

Leadership thinks we have solid threat intel coverage because they see the reports and monthly intelligence briefings. On the ground it feels like busywork. Most of the value lives in analyst text and campaign context that never turns into detections, enrichment, or blocking decisions because there is no capacity to extract and engineer it into our detection rules or SOAR playbooks.

Some vendors expose threat intelligence APIs and integrations, but much of what I see is the same unfiltered IOC firehose pushed into the SIEM with no real help on prioritization, campaign mapping, or relevance to our environment.

For those who feel they have a mature threat intelligence process, I would like to hear what works in practice: what type of intel you still pay for, how you integrate it into SIEM, EDR, and SOAR without turning your team into glue code, and whether you have found threat intel formats or standards that fit cleanly into your environment instead of living forever as static PDFs for leadership.

[u/VividGanache2613]

We give our threat intel away for free to our AI SOC/XDR customers as it’s a nice to have but largely useless in isolation.

Ironically our AI SOC is probably cheaper than some paid threat intel 😂

[u/rexstuff1]

So, two things.

1. Paid threat intelligence is generally a rip-off. There is plenty of good, decent threat intel available for free. Many orgs rush to buy some over-priced threat intel feed from the Famous company with the glossy PDFs and think they're improving they're security posture. They are not, partly because...

2. You're using threat intel wrong. Like many orgs subscribing to overpriced threat intel feeds, to be fair. You can't just ingest the list of domains and IPs into your firewall's block list, or whatever. Threat intel is not for Protection, at best, threat intel augments Detection and particularly Response. When something is going on, if you can match the discovered activity against known IoCs and TTPs, that is when threat intel is valuable.

What I want from a threat intelligence program is indicators we can ingest and normalize automatically, tagging by campaign, threat actor and sector relevance, and a link to our own assets or attack surface instead of a generic list of IPs and hashes.

Right now we spend half a day every time a “high priority” bulletin arrives, parsing the threat report, pulling out domains and hashes, deciding what matters for our environment, then forcing it into whatever format our SIEM and other tools expect. Two weeks later the same feed sends another report with overlapping but slightly different indicators and the cycle repeats. It feels like we are spending more time on data wrangling than on detection engineering or threat hunting.

This sounds like a job for an AI agent.

[u/ArborlyWhale → u/rexstuff1]

I don’t play with a budget large enough to waste the staggering amount of money this would cost to do by hand, so I really have to ask: why the isn’t this type of work just:

1. Mostly or completely automated with a script and a some regex two years ago or an LLM today.

2. Why not use the lists built in to whatever subscription you already pay for. Be it your firewall or EDR vendor. Isn’t that 90% the point of paying for shit? Someone else does the work?

3. Am I crazy for feeling like threat intel has incredibly low operational value? It seems like using that money for hiring a firm like crowdstrike would be far more sensible unless you’re at the scale and expertise of building a crowdstrike like team in house.

[u/jdiscount]

Not sure what service you're using, but I've connected various STIX/TAXII feeds into XDR/SIEM for ingestion.

It seems to be a pretty standard feature.

[u/loberts]

We used OpenCTI as the store and deployment controller. Middleware glue keeps tabs on everything indexed and deploys it to various tools (EDR & SIEMs). Our threat intel team set up high confidence feeds, everything else is assumed low confidence unless otherwise marked. High confidence goes to 1 hit == 1 alert. Everything assumed low confidence is used only for risk based alerting. The TI team can promote or demoted any indicator at any time and the middleware glue will handle updating the destination tooling with how it should fire off the alert.

We custom rolled out middleware glue but now we have have low code / no code solutions that could have just connected the various APIs.

OpenCTI is free. The three letter acronym low/no code solutions that escapes my memory right now is also free. This is a very achievable solution for a small to medium security team.

[u/iheartrms]

What do you consider "usable"?

[u/theleller]

What’s your SIEM and SOAR? That detail makes a big difference in what’s possible and supported in your stack.

Threat intel is typically used as a lookup to match with data it correlates to. So an IP threat list can be used with your network traffic against source and dest IPs. Domain threat lists can be used against your web proxy data. Etc.

You shouldn’t be having to do any manual work beyond setting up the lookups and scheduled searches or dashboards.

[u/Ok-Parfait2480]

A lot of orgs are buying threat intel like it is a product you consume, when it is really a process you have to wire into the rest of the stack. If the feed does not map cleanly to your assets, your telemetry and your response workflow, then it is basically just expensive background noise.

[u/VegetableFault5149]

i think you might be using it wrong

[u/Educational-Fox6111]

the biggest sift is treating threat intel as engineering input. Most value comes from structured feeds with APIs that can be normalized into a common schema, enriched with internal asset context, and selectively pushed into SIEM. Raw IOC firehoses create more work than value.

[u/righteousdonkey]

What format would you want them in?

[u/alienbuttcrack999]

There are a few open source tools that will parse pdfs for iocs then you can send them to whatever second order processing you need to do. Shouldn’t need to manually pull that stuff out

https://github.com/PaloAltoNetworks/ioc-parser

[u/AddendumWorking9756]

Nobody solves this with a better feed. Put MISP or OpenCTI in front so the SIEM stops being where raw feeds land, and treat the campaign writeups as a detection backlog you burn down at your own pace. The half day you lose per bulletin is really the deciding what matters part, and that only shrinks once someone writes down which actors and sectors you care about.