analyzing-threat-intelligence-feeds

To normalize and deduplicate OSINT threat intelligence feeds, this Skill ingests TAXII 2.1 or REST feed data and parses it into standardized STIX 2.1 indicators. It applies a unified schema for deduplication, preparing the indicators for enrichment and correlation.

You need a TAXII 2.1 server URL or a collection URL to ingest threat intel feeds into STIX format. Alternatively, you can provide an optional ioc-file as input. The pipeline also requires the taxii2-client and stix2 Python libraries to function.

The best way to automate CTI workflow ingestion for SIEM and incident response is to execute a full pipeline that fetches, deduplicates, and normalizes feed data. This Skill scores feed quality and exports enriched STIX bundles directly for security infrastructure consumption.

Yes, you can export enriched STIX 2.1 bundles for Threat Intelligence Platforms (TIPs). The Skill processes ingested feed data through normalization and deduplication, then exports the enriched indicators and context specifically for TIPs, SIEM, and incident response workflows.

Threat intelligence feeds require indicator normalization and deduplication to resolve inconsistencies and overlapping data from multiple OSINT sources. Standardizing them into a unified STIX 2.1 schema enables accurate threat detection, contextualization, and correlation across security tools.