Top open source and commercial threat intelligence feeds

Cybersecurity threat intelligence feeds provide critical data on attacks, including IPs, domains and malware hashes, helping teams detect and respond to threats effectively.

• Share this item with your network:

• Karen Kent, Trusted Cyber Annex

Cybersecurity threat intelligence feeds play an important role in security. They detail current attacks and their sources. These characteristics, better known as indicators of compromise, include, among other factors, IP addresses, domain names, URLs, email addresses, malware file hashes and filenames.

Security teams use this information to improve how quickly and accurately they can detect potential attacks and to better estimate the severity of an incursion. This helps prioritize the organization's response strategy -- especially automated responses.

A wide variety of cybersecurity tools -- among them firewalls, SIEM, security orchestration, automation and response and endpoint detection and response technologies -- consume machine-readable threat intelligence feeds. Organizations also use integrated threat intelligence platforms that bring together multiple feeds to ...