Analyzing Threat Intelligence Feeds

When to Use

Use this skill when:

• Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio
• Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema
• Evaluating feed freshness, fidelity, and relevance to the organization's threat profile
• Building automated enrichment pipelines that correlate IOCs against SIEM events

Do not use this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline.

Prerequisites

• Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI
• API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise)
• TAXII 2.1 client library (taxii2-client Python package or equivalent)
• Role with read/write permissions to the TIP's indicator database

Workflow