Log in Request a demo

Glossary

Threat Feed.

Also called Threat intelligence feed, Cyber threat feed, IOC feed

In Short

A threat feed is a stream of cyber threat information, such as indicators of compromise, that an organization receives from an outside source. Security teams load feeds into their tools so that known bad addresses, domains or files can be spotted. CISA describes one example, a service for the real-time exchange of machine-readable threat indicators.

Last updated October 23, 2026
Profile MapGlossary Term
  1. Also Called3other namesThreat intelligence feed · Cyber threat feed · IOC feed
  2. Related Terms3linked entriesIndicator of compromise (IoC) · Threat intelligence

What Is a Threat Feed?

A threat feed is a regular flow of threat information from a source outside your own organization. NIST describes cyber threat information as any information that can help an organization identify, assess, monitor, and respond to cyber threats. Feeds usually carry indicators, which are technical clues that suggest an attack is coming, is under way, or has already happened. Feeds can come from public bodies, sharing communities, or other providers, including the threat intelligence feeds of commercial vendors.

How Does a Feed Reach Your Tools?

CISA offers a good example. Its Automated Indicator Sharing service enables the real-time exchange of machine-readable cyber threat indicators and defensive measures between organizations. Machine-readable means a computer can read and use the data without a person retyping it. CISA says participants need a STIX and TAXII capability. CISA says an open source TAXII 2.1 client is available for this. STIX is a standard format for describing threat data, and TAXII is a standard way to send it.

CISA says the community that shares this way includes private companies, federal agencies, state and local governments, information sharing and analysis centers and international partners. It also says the service is offered at no cost to participants.

When Does a Feed Help, and When Does It Add Noise?

Attackers may reuse the same infrastructure, so a shared indicator can help one organization warn others. A feed can let a security team match its own logs against many indicators without collecting them by hand. Feeds also vary in quality, and an indicator that is old or wrong can create noise for the team that receives it.

Which Feeds Are Worth Connecting?

  • Decide what you want from a feed before you connect it, in line with the information sharing goals NIST describes.
  • Pick sources that fit your own sector and technology. If you run more than one, read about managing several threat feeds.
  • Send feed data into the tools that can act on it, such as a log platform or a threat intelligence platform.
  • Check results and remove sources that only add noise.

NIST says its guide covers how to set goals, identify sources and use threat information in security practice, and that sharing can improve the security posture of the organizations involved.

What Happens to an Indicator After It Arrives?

NIST SP 800-150 describes a multi-step process for indicators from outside feeds. The steps below follow the order NIST gives, then show how indicators are used. The order can change with your needs, and automation makes it faster.

Handling an Incoming Indicator, as NIST Describes It
  1. ValidateCheck the integrity and origin of the content with signatures, hashes or other means.
  2. Decrypt and unpackTurn encrypted or compressed files, such as zip or tar archives, back into their original format.
  3. ExtractParse the files and keep the indicators that matter to your organization.
  4. PrioritizeRank by value of the source, confidence in the data and effort needed to act.
  5. CategorizeRead the metadata for handling rules, since sensitive items may need encrypted storage.
  6. UseUpdate firewall or IDS rules, feed the SIEM and search logs for compromise.

NIST adds that indicators from an untrusted source may need independent validation or testing before use.

Is a Threat Feed the Same as Threat Intelligence?

No. A feed is raw data that arrives on a schedule. Threat intelligence is what analysts produce when they add context and judgment to data such as feeds, so that people can decide what to do.

Is a Threat Feed the Same as an Indicator of Compromise?

No. An indicator of compromise is one clue, for example a bad domain. A feed is the stream that delivers many such indicators.

Threat intelligence can be exchanged between systems using the open standards STIX and TAXII.

Sources

  • CISA: AIS enables real-time exchange of machine-readable cyber threat indicators between the public and private sectors, and needs a STIX and TAXII capability.
  • NIST: NIST SP 800-150 gives guidelines for threat information sharing and for consuming and using indicators (section 4.3).

Also Called.

  • NameThreat intelligence feed
  • NameCyber threat feed
  • NameIOC feed

Questions.

  • What is a threat feed?

    A threat feed is a regular flow of threat information, such as indicators of compromise, from a source outside your own organization. Feeds can come from public bodies, sharing communities, or other providers.

  • How does a threat feed work?

    CISA's Automated Indicator Sharing service enables the real-time exchange of machine-readable cyber threat indicators and defensive measures between organizations. Participants need a STIX and TAXII capability.

  • Why do threat feeds matter?

    Attackers may reuse the same infrastructure, so a shared indicator can help one organization warn others. A feed can let a security team match its own logs against many indicators without collecting them by hand.

In Our Research

  1. 1 Strengthening Cyber Defense with Advanced GenAI Threat Intelligence Feeds August 2024
  2. 2 How to Integrate and Manage Multiple Threat Feeds for Enhanced Security June 2024
  3. 3 Red Team Your Threat Intel Agent With Garak, Promptfoo and PyRIT October 2026
  4. 4 Agentic AI in Cybersecurity: How Autonomous Agents Are Transforming the SOC April 2026
  5. 5 From Weeks to Seconds: What AI Actually Changes in the CTI Lifecycle April 2026
  6. 6 Mobile App Impersonation: How a Fake Version of Your App Steals Your Users March 2026

Keep Exploring.

Knowledge Hub
101 guide Threat Intelligence Evaluation Checklist A tick-box checklist to score any threat intelligence provider on sources, coverage, enrichment, integration and noise. Open 101 guide Threat Intelligence Platforms 101 What a threat intelligence platform is, what it does with data, how it differs from a SIEM or a feed, and how to choose one. Open Glossary term STIX And TAXII STIX and TAXII are two open standards for sharing cyber threat intelligence. Open Article Looking At Your Company Through The Eyes Of An Attacker: What Is An Attacker’s-Eye View? What is an attacker's-eye view? Learn how to check your domains, subdomains, exposed services and email setup from the outside, as an attacker would. Open

Browse The Library.