analyzing-threat-intelligence-feeds

What problem does it solve?

Automates the ingestion and normalization of threat intelligence feeds into standardized STIX 2.1 indicators, enabling faster detection and contextualization of threats.

Core Features & Use Cases

• Ingests TAXII 2.1 or REST threat intel feeds and parses STIX 2.1 data.
• Deduplicates indicators and normalizes them into a unified schema for enrichment and correlation.
• Exports enriched indicators and context for SIEM, TIPs, and incident response workflows.

Quick Start

Configure a TAXII server URL or collection URL and execute the full pipeline to fetch, deduplicate, normalize to STIX 2.1, score feed quality, and export STIX bundles.