Intelligence Sources

Intelligence

Effective threat intelligence requires diverse, reliable sources. This guide covers commercial platforms, open-source tools, community feeds, and dark web monitoring resources.

Source Quality

Not all intelligence is equal. Evaluate sources based on timeliness, accuracy, relevance to your environment, and actionability. A smaller set of high-quality sources beats a flood of low-quality data.

Open Source Threat Feeds

AlienVault OTX

Community-driven threat exchange with pulses containing IOCs and context.

otx.alienvault.com

MalwareBazaar

Malware sample repository by abuse.ch with daily updates and API access.

bazaar.abuse.ch

URLhaus

Database of malicious URLs used for malware distribution. Daily feeds available.

urlhaus.abuse.ch

ThreatFox

IOC database focused on malware and botnet C2 infrastructure.

threatfox.abuse.ch

Feodo Tracker

Tracks botnet C2 servers associated with Dridex, Emotet, TrickBot, QakBot.

feodotracker.abuse.ch

SSL Blacklist

SHA1 fingerprints of malicious SSL certificates used by botnets.

sslbl.abuse.ch

Fetching Threat Feeds

# abuse.ch feeds
# MalwareBazaar recent samples
curl -s "https://mb-api.abuse.ch/api/v1/" -d "query=get_recent&selector=100"

# URLhaus recent URLs
curl -s "https://urlhaus.abuse.ch/downloads/csv_recent/"

# ThreatFox IOCs (last 7 days)
curl -s "https://threatfox-api.abuse.ch/api/v1/" -d '{"query":"get_iocs","days":7}'

# Feodo Tracker botnet C2s
curl -s "https://feodotracker.abuse.ch/downloads/ipblocklist.csv"

# AlienVault OTX
curl -s "https://otx.alienvault.com/api/v1/pulses/subscribed" \
  -H "X-OTX-API-KEY: YOUR_API_KEY"

# VirusTotal file report
curl -s "https://www.virustotal.com/api/v3/files/SHA256" \
  -H "x-apikey: YOUR_API_KEY"

Government & Industry Sources

CISA

Cybersecurity & Infrastructure Security Agency. Known Exploited Vulnerabilities (KEV), alerts, and advisories.

• KEV Catalog: cisa.gov/known-exploited-vulnerabilities
• Alerts: cisa.gov/uscert/ncas/alerts

FBI IC3

Internet Crime Complaint Center. Public Service Announcements on cyber threats.

ic3.gov

NCSC

UK National Cyber Security Centre. Threat reports, guidance, and weekly threat reports.

ncsc.gov.uk/threat-reports

MITRE ATT&CK

Knowledge base of adversary tactics and techniques based on real-world observations.

attack.mitre.org

FS-ISAC

Financial Services Information Sharing and Analysis Center. Financial sector threat sharing.

fsisac.com

H-ISAC

Health Information Sharing and Analysis Center. Healthcare sector threat intelligence.

h-isac.org

# CISA Known Exploited Vulnerabilities (KEV)
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | jq '.vulnerabilities[:5]'

# CISA KEV - Filter by recent additions
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  jq '.vulnerabilities | sort_by(.dateAdded) | reverse | .[0:10]'

# NVD CVE feed
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=5" | jq '.vulnerabilities'

Commercial Intelligence Platforms

Platform	Focus	Key Features
Recorded Future	All-source intelligence	Real-time alerts, dark web monitoring, NLP analysis
Mandiant Advantage	Threat actor tracking	Incident response expertise, actor profiles, malware analysis
CrowdStrike Falcon X	Adversary intelligence	Actor tracking, malware sandbox, automated analysis
Intel 471	Cybercrime intelligence	Underground monitoring, malware intel, adversary tracking
Flashpoint	Risk intelligence	Dark web, fraud, physical security threats
Digital Shadows	Digital risk protection	Brand monitoring, data leak detection, attack surface
GreyNoise	Internet noise filtering	Mass scanning detection, benign traffic identification
Shodan	Attack surface	Internet-connected device search, vulnerability detection

Open Source Intelligence Platforms

MISP

Docs

Open source threat intelligence platform for sharing, storing, and correlating IOCs.

OpenCTI

Docs

Open source platform for managing cyber threat intelligence knowledge and observables.

TheHive

Docs

Scalable security incident response platform with MISP and Cortex integration.

Cortex

Docs

Observable analysis and active response engine. Analyze IPs, domains, files, and more.

IntelOwl

Docs

Analyze files, domains, and IPs using multiple services at once.

Yeti

Docs

Platform to organize observables, indicators, and knowledge on threats.

Setting Up MISP

# Docker deployment
git clone https://github.com/MISP/misp-docker.git
cd misp-docker
cp template.env .env
# Edit .env with your settings
docker-compose up -d

# MISP PyMISP API usage
from pymisp import PyMISP

misp = PyMISP('https://misp.local', 'YOUR_API_KEY', ssl=False)

# Search for IOCs
results = misp.search(controller='attributes', value='192.168.1.1')

# Add an event
event = misp.new_event(
    distribution=0,
    info='Suspicious activity detected',
    analysis=1,
    threat_level_id=2
)

# Add attributes to event
misp.add_attribute(event, {'type': 'ip-dst', 'value': '192.168.1.100'})
misp.add_attribute(event, {'type': 'sha256', 'value': 'abc123...'})

Setting Up OpenCTI

# Docker deployment
git clone https://github.com/OpenCTI-Platform/docker.git
cd docker
cp .env.sample .env
# Edit .env with your settings
docker-compose up -d

# OpenCTI Python client
from pycti import OpenCTIApiClient

api = OpenCTIApiClient(
    url='http://localhost:8080',
    token='YOUR_TOKEN'
)

# Search for malware
malware = api.malware.list(
    filters=[{"key": "name", "values": ["Cobalt Strike"]}]
)

# Get indicators
indicators = api.indicator.list(first=50)
for ind in indicators:
    print(f"{ind['pattern_type']}: {ind['pattern']}")

Dark Web Monitoring

Monitor underground forums, marketplaces, and paste sites for threat intelligence relevant to your organization.

What to Monitor

• Credential dumps (employee emails)
• Data breach announcements
• Initial access broker listings
• Ransomware victim announcements
• Vulnerability discussions & exploits
• Mentions of your organization

Safety Considerations

• Use dedicated VMs and Tor Browser
• Never use work credentials
• Don't interact or purchase
• Document for legal purposes only
• Consider commercial services
• Know your legal boundaries

Paste Site Monitoring

# Search paste sites for leaked credentials
# Note: Use responsibly and legally

# Pastebin search (via Google)
site:pastebin.com "company.com" OR "company email"

# GitHub secret scanning
# Search for accidentally committed secrets
trufflehog git https://github.com/org/repo

# GitLeaks
gitleaks detect --source=/path/to/repo --report-format=json

# Dehashed API (requires subscription)
curl "https://api.dehashed.com/search?query=domain:company.com" \
  -H "Accept: application/json" \
  -u "email:api_key"

# Have I Been Pwned domain search
curl -s "https://haveibeenpwned.com/api/v3/breaches" \
  -H "hibp-api-key: YOUR_API_KEY"

# Check if email is in breaches
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/user@company.com" \
  -H "hibp-api-key: YOUR_API_KEY"

Vendor Threat Reports

Security vendors publish valuable threat research. Key resources include:

Microsoft

Microsoft Threat Intelligence Blog, MSRC

Google TAG

Threat Analysis Group bulletins

Mandiant

M-Trends, threat research reports

CrowdStrike

Global Threat Report, adversary reports

Cisco Talos

Talos Intelligence blog

Unit 42

Palo Alto Networks threat research

Proofpoint

Threat Insight blog

Sophos

Sophos X-Ops research

Secureworks

Counter Threat Unit research

Building a Feed Aggregator

#!/usr/bin/env python3
"""Simple threat feed aggregator"""

import requests
import json
from datetime import datetime

FEEDS = {
    'urlhaus': 'https://urlhaus.abuse.ch/downloads/json_recent/',
    'feodo': 'https://feodotracker.abuse.ch/downloads/ipblocklist.json',
    'threatfox': 'https://threatfox-api.abuse.ch/api/v1/'
}

def fetch_urlhaus():
    resp = requests.get(FEEDS['urlhaus'])
    data = resp.json()
    return [{'type': 'url', 'value': u['url'], 'threat': u['threat']} 
            for u in data.get('urls', [])[:100]]

def fetch_feodo():
    resp = requests.get(FEEDS['feodo'])
    data = resp.json()
    return [{'type': 'ip', 'value': e['ip_address'], 'threat': e['malware']} 
            for e in data]

def fetch_threatfox():
    resp = requests.post(FEEDS['threatfox'], json={'query': 'get_iocs', 'days': 1})
    data = resp.json()
    return [{'type': i['ioc_type'], 'value': i['ioc'], 'threat': i['malware']} 
            for i in data.get('data', [])[:100]]

def main():
    all_iocs = []
    all_iocs.extend(fetch_urlhaus())
    all_iocs.extend(fetch_feodo())
    all_iocs.extend(fetch_threatfox())
    
    output = {
        'generated': datetime.utcnow().isoformat(),
        'count': len(all_iocs),
        'iocs': all_iocs
    }
    
    with open('aggregated_iocs.json', 'w') as f:
        json.dump(output, f, indent=2)
    
    print(f"Aggregated {len(all_iocs)} IOCs")

if __name__ == '__main__':
    main()

Feed Management Best Practices

• Deduplicate IOCs across feeds to avoid alert fatigue
• Set expiration dates - stale IOCs create false positives
• Enrich IOCs with context before operationalizing
• Track IOC sources for quality assessment
• Automate feed ingestion with scheduled jobs

Evidence to Capture

A source register is the artefact. If you cannot say when a feed was last pulled, what it is licensed for and what it cost you in analyst time, it is not a managed source.

Publisher and provenance: Who publishes the feed, whether the data is first-party telemetry or aggregation, and any government or ISAC attribution behind it.

Access terms: Licence, redistribution restrictions and API rate limits. A feed that cannot legally reach the platform is not a source.

Cadence and last retrieval: The published cadence against your actual ingestion cadence, with the last successful pull timestamp recorded.

Coverage statement: What the source covers — sector, geography, indicator type — and what it demonstrably does not.

Reliability grade: The internal rating assigned after a period of use, with the evidence for it: true-positive rate, duplication rate and analyst time consumed.

Retirement record: Why a source was dropped, so it is not re-onboarded and re-evaluated from scratch next year.

Feed Noise and Misleading Sources

A feed entry usually describes somebody else incident, in somebody else environment, from a source paid to produce volume.

Indicators from other people incidents: An indicator that never touched your estate is context, not a hit. Operationalising it produces alerts with no investigative value.
Scanner and honeypot captures: Internet-wide scan data and honeypot logs contain every opportunistically scanning address on the internet.
Restated reporting: One vendor report is re-published by ten aggregators. Ingesting all of them makes a single incident look like ten and inflates its apparent severity.
Sinkholed infrastructure: Indicator sets captured after a takedown describe infrastructure that was dead before it reached the feed.
Lead-generation reports: Vendor content written for marketing often carries no indicators, and the ones it does carry cannot be verified against a telemetry source.
Stale reputation: A source accurate two years ago and since degraded still reports with full confidence. Grade on recent performance, not on history.

Feed Hygiene and Source Accountability

There is no patch here. The corrective work is ingesting once, attributing always, and retiring what produces noise.

Ingest once, attribute always

• Deduplicate by canonical indicator value and keep the contributing source list
• Prefer the originating publisher over its aggregators
• Tag every alert with the source that produced it

Grade and prune

• Review each source quarterly against true-positive rate and analyst time consumed
• Demote or drop sources that only restate other publishers
• Record every retirement with the reason

Intelligence Sources

Open Source Threat Feeds

AlienVault OTX

MalwareBazaar

URLhaus

ThreatFox

Feodo Tracker

SSL Blacklist

Fetching Threat Feeds

Government & Industry Sources

CISA

FBI IC3

NCSC

MITRE ATT&CK

FS-ISAC

H-ISAC

Commercial Intelligence Platforms

Open Source Intelligence Platforms

MISP

OpenCTI

TheHive

Cortex

IntelOwl

Yeti

Setting Up MISP

Setting Up OpenCTI

Dark Web Monitoring

What to Monitor

Safety Considerations

Paste Site Monitoring

Vendor Threat Reports

Microsoft

Google TAG

Mandiant

CrowdStrike

Cisco Talos

Unit 42

Proofpoint

Sophos

Secureworks

Building a Feed Aggregator

Evidence to Capture

Feed Noise and Misleading Sources

Feed Hygiene and Source Accountability

There is no patch here. The corrective work is ingesting once, attributing always, and retiring what produces noise.

Ingest once, attribute always

Grade and prune

Review trigger

Related Topics

IOC Analysis

Threat Actors

OSINT

Threat Modeling