Threat Feed.

What is a threat feed?

A threat feed is a regular flow of threat information from a source outside your own organization. NIST describes cyber threat information as any information that can help an organization identify, assess, monitor, and respond to cyber threats. Feeds usually carry indicators, which are technical clues that suggest an attack is coming, is under way, or has already happened. Feeds can come from public bodies, sharing communities, or other providers.

How does a threat feed work?

CISA offers a good example. Its Automated Indicator Sharing service enables the real-time exchange of machine-readable cyber threat indicators and defensive measures between organizations. Machine-readable means a computer can read and use the data without a person retyping it. CISA says participants need a STIX and TAXII capability. CISA says an open source TAXII 2.1 client is available for this. STIX is a standard format for describing threat data, and TAXII is a standard way to send it.

CISA says the community that shares this way includes private companies, federal agencies, state and local governments, information sharing and analysis centers and international partners. It also says the service is offered at no cost to participants.

Why does it matter?

Attackers may reuse the same infrastructure, so a shared indicator can help one organization warn others. A feed can let a security team match its own logs against many indicators without collecting them by hand. This is general reasoning. Feeds also vary in quality, and an indicator that is old or wrong can create noise for the team that receives it.

How can you use feeds well?

• Decide what you want from a feed before you connect it, in line with the information sharing goals NIST describes.
• Pick sources that fit your own sector and technology.
• Send feed data into the tools that can act on it, such as a log platform or a threat intelligence platform.
• Check results and remove sources that only add noise.

NIST says its guide covers how to set goals, identify sources and use threat information in security practice, and that sharing can improve the security posture of the organizations involved.

Is a threat feed the same as threat intelligence?

No. A feed is raw data that arrives on a schedule. Threat intelligence is what analysts produce when they add context and judgment to data such as feeds, so that people can decide what to do.

Is a threat feed the same as an indicator of compromise?

No. An indicator of compromise is one clue, for example a bad domain. A feed is the stream that delivers many such indicators.

Threat intelligence can be exchanged between systems using the open standards STIX and TAXII.

Sources

• CISA: AIS enables real-time exchange of machine-readable cyber threat indicators between public and private sector; server/client; STIX/TAXII, open source TAXII 2.1 client;….
• NIST: NIST SP 800-150 provides guidelines for threat information sharing and helps identify threat information sources; threat information includes indicators and TTPs.