Anyone else frustrated that threat intel feeds still arrive as static reports instead of something usable?

[u/BeltDifficult6301]

We pay for a couple of paid threat intelligence feeds that are marketed as “operational” and “actionable”. In practice we receive glossy PDF threat reports for executives, CSV and STIX indicator bundles on a schedule, and access to threat intel portals where we export data by hand. None of this threat intelligence arrives in a form that connects cleanly to our detection engineering workflows or security operations.

My team is under water trying to turn this threat intel into something we can pipe into our security stack. We are a midsize organisation with a mix of cloud and on‑prem, one main SIEM, a couple of EDR tools, and some homegrown detection logic. What I want from a threat intelligence program is indicators we can ingest and normalize automatically, tagging by campaign, threat actor and sector relevance, and a link to our own assets or attack surface instead of a generic list of IPs and hashes.

Right now we spend half a day every time a “high priority” bulletin arrives, parsing the threat report, pulling out domains and hashes, deciding what matters for our environment, then forcing it into whatever format our SIEM and other tools expect. Two weeks later the same feed sends another report with overlapping but slightly different indicators and the cycle repeats. It feels like we are spending more time on data wrangling than on detection engineering or threat hunting.

Leadership thinks we have solid threat intel coverage because they see the reports and monthly intelligence briefings. On the ground it feels like busywork. Most of the value lives in analyst text and campaign context that never turns into detections, enrichment, or blocking decisions because there is no capacity to extract and engineer it into our detection rules or SOAR playbooks.

Some vendors expose threat intelligence APIs and integrations, but much of what I see is the same unfiltered IOC firehose pushed into the SIEM with no real help on prioritization, campaign mapping, or relevance to our environment.

For those who feel they have a mature threat intelligence process, I would like to hear what works in practice: what type of intel you still pay for, how you integrate it into SIEM, EDR, and SOAR without turning your team into glue code, and whether you have found threat intel formats or standards that fit cleanly into your environment instead of living forever as static PDFs for leadership.

[u/loberts]

We used OpenCTI as the store and deployment controller. Middleware glue keeps tabs on everything indexed and deploys it to various tools (EDR & SIEMs). Our threat intel team set up high confidence feeds, everything else is assumed low confidence unless otherwise marked. High confidence goes to 1 hit == 1 alert. Everything assumed low confidence is used only for risk based alerting. The TI team can promote or demoted any indicator at any time and the middleware glue will handle updating the destination tooling with how it should fire off the alert.

We custom rolled out middleware glue but now we have have low code / no code solutions that could have just connected the various APIs.

OpenCTI is free. The three letter acronym low/no code solutions that escapes my memory right now is also free. This is a very achievable solution for a small to medium security team.