{"id":7757,"date":"2024-05-08T13:04:43","date_gmt":"2024-05-08T13:04:43","guid":{"rendered":"\/cybersecurity-blog\/?p=7757"},"modified":"2025-01-31T05:31:07","modified_gmt":"2025-01-31T05:31:07","slug":"how-to-use-threat-intelligence-feeds","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/","title":{"rendered":"How to Use Threat Intelligence Feeds"},"content":{"rendered":"\n<p>Threat Intelligence Feeds are an essential part of your cybersecurity perimeter \u2014 if you use this tool correctly, you can increase your chances of detecting an attack \u2014 it&#8217;s like getting near real-time reports about the enemy from the front lines.&nbsp;&nbsp;<\/p>\n\n\n\n<p>But do you know how to effectively use and operationalize threat intelligence feeds? Let\u2019s discuss this in today\u2019s article.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What are threat intelligence feeds?&nbsp;<\/h2>\n\n\n\n<p>First, let&#8217;s review what threat intelligence feeds are. Cyber Threat Intelligence (CTI) feeds are a real-time subscription service for the latest cyber threat information, like malicious IPs, and URLs.&nbsp;&nbsp;<\/p>\n\n\n\n<p>And just as you can sign up for a newsletter to receive news about world events, you can sign up for updates on the latest malicious indicators that security experts have discovered in the wild.&nbsp;<\/p>\n\n\n\n<p>Think of it this way: when an organization is attacked somewhere, they analyze the threat and get IOCs from it. They can then choose to share the details with a feed vendor like <a href=\"http:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_use_feeds&amp;utm_term=090524&amp;utm_content=linktolanding\/\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>.&nbsp;<\/p>\n\n\n\n<p>(<a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-feeds\/\" target=\"_blank\" rel=\"noreferrer noopener\">Learn more about TI Feeds from ANY.RUN<\/a>)&nbsp;<\/p>\n\n\n\n<p>This vendor then pre-processes the indicators, removes false positives, and makes them available for anyone to use. The benefit is that you can digest these IOCs in your security systems and your organization obtains immunity to these attacks.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Types of TI Feeds&nbsp;<\/h2>\n\n\n\n<p>CTI Feeds can be either commercial or open source. Let&#8217;s discuss the difference:&nbsp;<\/p>\n\n\n\n<p><strong>Commercial threat intelligence feeds<\/strong> contain data collected and pre-processed by a cybersecurity vendor in a proprietary manner.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p>They are typically more limited in scope, but the data contains fewer false positives and benefits from unique processing and sourcing \u2014&nbsp; for example, ANY.RUN sources its data from analysis sessions of the latest malware samples uploaded to its sandbox by a global community of over 400,000 cybersecurity professionals.<\/p>\n\n\n\n<p>(<a href=\"https:\/\/any.run\/cybersecurity-blog\/how-we-process-iocs\/\" target=\"_blank\" rel=\"noreferrer noopener\">Read how we source and process indicators for ANY.RUN TI Feeds<\/a>)<\/p>\n\n\n\n<p>For example, in ANY.RUN TI Feeds, indicators are enriched with links to sandbox analysis sessions where the indicator was pulled from, which looks like this:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code style=\"white-space: pre-wrap;\">\"external_references\": &#91;  \n    {  \n      \"source_name\": \"ANY.RUN task c761d29c-a02a-4666-bc34-b89c4aab5cd1\",  \n      \"url\": \"https:\/\/app.any.run\/tasks\/c761d29c-a02a-4666-bc34-b89c4aab5cd1\"  \n    },  \n    {  \n      \"source_name\": \"ANY.RUN task 49e5fc75-a203-4d98-b055-ce41b0597a42\",  \n      \"url\": \"https:\/\/app.any.run\/tasks\/49e5fc75-a203-4d98-b055-ce41b0597a42\"  \n    },  \n    {  \n      \"source_name\": \"ANY.RUN task 3438d5ce-3cfa-4ccc-9638-5d92ad34b406\",  \n      \"url\": \"https:\/\/app.any.run\/tasks\/3438d5ce-3cfa-4ccc-9638-5d92ad34b406\"  \n    }  \n] <\/code><\/pre>\n\n\n\n<p>This is valuable, because security professionals can open these recordings and study how the threat behaves within a system.&nbsp;<\/p>\n\n\n\n<p>That&#8217;s a unique benefit of ANY.RUN&#8217;s TI Feeds that no other vendor can provide.&nbsp;<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nTry ANY.RUN&#8217;s TI Feeds sample <span class=\"highlight\">for free<\/span>&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/intelligence.any.run\/feeds\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=how_to_use_feeds&#038;utm_term=090524&#038;utm_content=linktotifeeds\/\" rel=\"noopener\" target=\"_blank\">\nTry it\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p>In summary:<\/p>\n\n\n\n<!-- Highlight Block HTML START -->\n<div class=\"window\">\n  <div class=\"window-header\">\n    <div class=\"pill\">\u261d\ufe0f Pros of commercial TI feeds:<\/div>\n  <\/div>\n  <div class=\"window-body\">\n    <ul>\n      <li>More accurate pre-processing.<\/li>\n      <li>Information about the latest threats.<\/li>\n    <\/ul>\n  <\/div>\n<\/div>\n<!-- Highlight Block HTML END -->\n\n\n<!-- Highlight Block CSS START -->\n<style>\n  .window {\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n\n    border-radius: 4px;\n    margin: 20px auto 50px auto;\n    padding: 20px 40px;\n    line-height: 2rem;\n  }\n\n  .window-header {\n    display: flex;\n    justify-content: center;\n    margin-bottom: 20px;\n  }\n\n  .pill {\n    background-color: #fff;\n    border-radius: 20px;\n    color: #333;\n    font-weight: bold;\n    padding: 8px 32px;\nborder: 1px solid rgba(75, 174, 227, 0.32);\n  }\n\n  @media (max-width: 480px) {\n    .window {\n      padding: 10px;\n    }\n    \n    .pill {\n      font-size: 14px;\n      padding: 6px 12px;\n    }\n  }\n<\/style>\n<!-- Highlight Block CSS END -->\n\n\n\n<p><strong>Open source cyber threat intelligence feeds<\/strong> contain data that companies have chosen to share with a non-profit or government agency that has taken it upon itself to centralize that data and distribute it to other companies.&nbsp;&nbsp;<\/p>\n\n\n\n<p>In open source threat intelligence feeds, the sheer volume of data can far exceed what many commercial threat data feeds can provide, but the data is less accurate.\u00a0Still, utilizing threat intelligence feeds open source information is a cost-effective way to bolster your cybersecurity defenses.<\/p>\n\n\n\n<p>Remember that the database of commercial malware feeds relies on data provided by the community, and if a company contributing to the feed has unreliable reporting, its errors will be carried over into the feed.&nbsp;That is why it is impossible to find the best threat intelligence feeds and you will need to integrate several solutions most of the time. <\/p>\n\n\n\n<p>Below we\u2019ve listed 5 examples of popular free threat feeds and who runs them:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.dhs.gov\/cisa\/automated-indicator-sharing-ais\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Automated Indicator Sharing, Department of Homeland Security<\/a>&nbsp;<\/li>\n\n\n\n<li><a href=\"https:\/\/www.infragard.org\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">InfraGard Portal, FBI<\/a>&nbsp;<\/li>\n\n\n\n<li><a href=\"http:\/\/abuse.ch\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Abuse.ch<\/a>&nbsp;<\/li>\n\n\n\n<li><a href=\"https:\/\/isc.sans.edu\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Internet Storm Center, Sans<\/a>&nbsp;<\/li>\n\n\n\n<li><a href=\"https:\/\/www.spamhaus.org\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">The Spamhaus Project<\/a>&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>In summary, the benefits of free open-source threat intelligence feeds are:&nbsp;<\/p>\n\n\n\n<!-- Highlight Block HTML START -->\n<div class=\"window\">\n  <div class=\"window-header\">\n    <div class=\"pill\">\u261d\ufe0f Pros of open-source TI feeds:<\/div>\n  <\/div>\n  <div class=\"window-body\">\n    <ul>\n      <li>Wider threat coverage.<\/li>\n      <li>Free to integrate.<\/li>\n    <\/ul>\n  <\/div>\n<\/div>\n<!-- Highlight Block HTML END -->\n\n\n<!-- Highlight Block CSS START -->\n<style>\n  .window {\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n\n    border-radius: 4px;\n    margin: 20px auto 50px auto;\n    padding: 20px 40px;\n    line-height: 2rem;\n  }\n\n  .window-header {\n    display: flex;\n    justify-content: center;\n    margin-bottom: 20px;\n  }\n\n  .pill {\n    background-color: #fff;\n    border-radius: 20px;\n    color: #333;\n    font-weight: bold;\n    padding: 8px 32px;\nborder: 1px solid rgba(75, 174, 227, 0.32);\n  }\n\n  @media (max-width: 480px) {\n    .window {\n      padding: 10px;\n    }\n    \n    .pill {\n      font-size: 14px;\n      padding: 6px 12px;\n    }\n  }\n<\/style>\n<!-- Highlight Block CSS END -->\n\n\n\n<h2 class=\"wp-block-heading\">Which type of feed is best for you?&nbsp;<\/h2>\n\n\n\n<p>The short answer is that you should consider both.&nbsp;<\/p>\n\n\n\n<p>It&#8217;s rare for data from two vendors to contradict each other, so the more data you process, the more threats you can keep on your radar at all times.&nbsp;<\/p>\n\n\n\n<p><strong>Why consider commercial feeds<\/strong>: Because they can provide more relevant and accurate data about the latest threats.&nbsp;<\/p>\n\n\n\n<p><strong>Why consider open source threat feeds<\/strong>: Because they exponentially increase your overall threat coverage.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u261d\ufe0f But be mindful of indicator fatigue&nbsp;<\/h3>\n\n\n\n<p>Indicator fatigue affects the security team when their workspace is constantly flooded with alerts, many of which are false, which is a common problem for open threat intelligence feeds.<\/p>\n\n\n\n<p>It creates a deceptive sense of security and blunts the response time when a real alert rolls in. It can even cause the alert to be ignored.&nbsp;&nbsp;<\/p>\n\n\n\n<p>To avoid indicator fatigue, filter indicators based on the reputation of the source, how old the indicator is, and whether it contains contextual information.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">In which format do TI feeds send data&nbsp;<\/h2>\n\n\n\n<p>For consistency, all major threat intelligence feeds use the same format called STIX (Structured Threat Information Expression) \u2014 this is an industry-standard format for exchanging cyber threat information (CTI).<\/p>\n\n\n\n<p>Mostsecurity systems \u2014 and certainly all from major vendors \u2014 are capable of ingesting STIX-formatted data.&nbsp;<\/p>\n\n\n\n<p>So the good news is that integrating threat feeds requires very little setup from a technical standpoint. While the exact steps vary from vendor to vendor, all you need to do is obtain an API key and plug it into your SIEM (Security Information and Event Management)&nbsp;or TIP (Threat Intelligence Platform)&nbsp;system.&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code style=\"white-space: pre-wrap;\">{  \n  \"type\": \"ipv4-addr\",  \n  \"id\": \"ipv4-addr--8c851c0c-ee42-5e7e-af06-f849efc0ffb4\",  \n  \"value\": \"194.104.136.5\",  \n  \"created\": \"2022-04-20T15:05:54.181Z\",  \n  \"modified\": \"2024-02-19T11:21:47.728Z\",  \n  \"external_references\": &#91;  \n    {  \n      \"source_name\": \"ANY.RUN task c761d29c-a02a-4666-bc34-b89c4aab5cd1\",  \n      \"url\": \"https:\/\/app.any.run\/tasks\/c761d29c-a02a-4666-bc34-b89c4aab5cd1\"  \n    } \n  ],  \n  \"labels\": &#91;  \n    \"RedLine\"  \n  ]  \n} <\/code><\/pre>\n\n\n\n<p>STIX is a JSON-based data format. The example above shows how a single object is structured in ANY.RUN TI feeds. &nbsp;<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nIntegrate <span class=\"highlight\">ANY.RUN TI Feeds<\/span> into your security systems&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/intelligence.any.run\/plans\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=how_to_use_feeds&#038;utm_term=090524&#038;utm_content=linktotiplans\/\" rel=\"noopener\" target=\"_blank\">\nContact Sales\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p>Note the fields for <strong>type <\/strong>(what this IOC is), <strong>value<\/strong>, <strong>timestamps<\/strong> (how new it is and when it was last updated), <strong>external references <\/strong>(in which sandbox session or sessions it was captured), and <strong>label <\/strong>(what threat it is associated with).&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to operationalize data from TI feeds&nbsp;<\/h2>\n\n\n\n<p>As we mentioned earlier, TI feeds are typically ingested into SIEM and TIP systems. &nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SIEM systems: Collect, analyze, and correlate security events from multiple sources; data from TI feeds helps to better analyze these events.&nbsp;<\/li>\n\n\n\n<li>TIP systems: Contextualize indicators and build them into threat objects to get a more holistic view of the attack, enabling better prioritization and decision-making.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>With the right setup, you can get more value out of this data. Here are a few things to consider:&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configure the ingestion frequency&nbsp;<\/h3>\n\n\n\n<p>Ingestion frequency controls how often you receive new data from TI feeds. &nbsp;<\/p>\n\n\n\n<p>This setting depends on your cybersecurity strategy, and largely on how confident you are in your ability to structure and filter usable data from open source sources. &nbsp;<\/p>\n\n\n\n<p>For example, one strategy might be to ingest data from more accurate commercial feeds as often as possible, and update open source feeds that have more data but are less accurate periodically to reduce noise and put less strain on your network.&nbsp;<\/p>\n\n\n\n<p><strong>For commercial feeds<\/strong>: Refresh commercial feeds in real time or as often as the vendor allows to minimize the time lag between when the indicator appears in the vendor&#8217;s database and when it enters your security systems.&nbsp;<\/p>\n\n\n\n<p><strong>For open source feeds: <\/strong>To minimize noise and avoid information overload, consider refreshing open source feeds periodically. Use them to enrich data from commercial feeds or to expand your coverage.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Set up data enrichment rules in your TIP to add context to the ingested indicators&nbsp;<\/h3>\n\n\n\n<p>Enriching TI data provides additional context to help you prioritize threats and make more accurate incident response decisions. &nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"566\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-1024x566.png\" alt=\"\" class=\"wp-image-7759\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-1024x566.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-300x166.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-768x425.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-1536x849.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-370x205.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-270x149.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle-740x409.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/05\/tifeedsarticle.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Enrich the data you receive from feeds with additional context in a TIP platform such as OpenCTI.<\/figcaption><\/figure><\/div>\n\n\n<p>For example, in OpenCTI, you can use the ANY.RUN sandbox connector to enrich the data you receive from feeds with more context, such as TTPs and maliciousness scores.&nbsp;<\/p>\n\n\n\n<p>(<a href=\"https:\/\/any.run\/cybersecurity-blog\/opencti-integration\/\" target=\"_blank\" rel=\"noreferrer noopener\">Read how ANY.RUN integrates with OpenCTI<\/a>)&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configure SIEM correlation rules to detect patterns and threats&nbsp;<\/h3>\n\n\n\n<p>Once you have ingested and enriched the data from TI feeds, the next step is to configure correlation rules in your SIEM system.&nbsp;<\/p>\n\n\n\n<p>These rules help identify patterns and detect potential threats by analyzing the data from various sources, including TI feeds.&nbsp;&nbsp;<\/p>\n\n\n\n<p><strong>Prioritize high-confidence indicators<\/strong>: Focus on indicators with high confidence scores to reduce false positives and avoid indicator fatigue.&nbsp;<\/p>\n\n\n\n<p><strong>Combine multiple indicators<\/strong>: Create correlation rules that look for multiple related indicators, such as a combination of IP addresses, domain names, and file hashes associated with a specific threat.&nbsp;<\/p>\n\n\n\n<p>You can then use this data to automatically trigger response actions based on the severity and confidence of the threats detected. For example, you can configure your system to automatically block IP addresses or domain names associated with high confidence indicators.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Wrapping up&nbsp;<\/h2>\n\n\n\n<p>With TI Feeds integration, you can get indicators from real attacks that have happened elsewhere in the world before they hit your organization.&nbsp; &nbsp;<\/p>\n\n\n\n<p>If you are interested in integrating TI Feeds, consider a solution from ANY.RUN. You can get a sample of <a href=\"https:\/\/intelligence.any.run\/feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_use_feeds&amp;utm_term=090524&amp;utm_content=linktotifeeds\/\" target=\"_blank\" rel=\"noreferrer noopener\">free threat intelligence feeds<\/a> in STIX and MISP format.<\/p>\n\n\n\n<p>We would be happy to tell you more about how we collect and pre-process indicators \u2014 and why we are able to extract IOCs from threats that no other vendor can, helping you protect against the latest emerging malware.<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nLearn more about TI Feeds <span class=\"highlight\">on a quick call<\/span>&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/calendly.com\/d\/3nd-rzd-xvx\/any-run-demo-blog\/\" rel=\"noopener\" target=\"_blank\">\nTalk to our team\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN&nbsp;&nbsp;<\/h2>\n\n\n\n<p>ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">TI Lookup<\/a>, <a href=\"https:\/\/any.run\/cybersecurity-blog\/yara-search\/\" target=\"_blank\" rel=\"noreferrer noopener\">Yara Search<\/a>, and <a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-feeds\/\" target=\"_blank\" rel=\"noreferrer noopener\">Feeds<\/a>, help you find IOCs or files to learn more about the threats and respond to incidents faster.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Advantages of ANY.RUN&nbsp;&nbsp;<\/h3>\n\n\n\n<p>ANY.RUN helps you analyze threats faster while improving detection rates. The platform detects common malware families with YARA and Suricata rules and identifies malware behavior with signatures when detection by family is not possible.&nbsp;<\/p>\n\n\n\n<p>With ANY.RUN you can:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Detect malware in under 40s<\/strong>: ANY.RUN detects malware within about 40 seconds of a file upload. It identifies prevalent malware families using YARA and Suricata rules and uses behavioral signatures to detect malicious actions when you encounter a new threat.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Interact with samples in real time<\/strong>: ANY.RUN is an interactive cloud sandbox powered by VNC, which means that you can do everything you could on a real system: browse webpages, click through installers, open password-protected archives.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Save time and money on sandbox setup and maintenance<\/strong>: ANY.RUN\u2019s cloud-based nature eliminates the need for setup or maintenance by your DevOps team, making it a cost-effective solution for businesses.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Record and study all aspects of malware behavior<\/strong>: ANY.RUN provides a detailed analysis of malware behavior, including network traffic, system calls, and file system changes.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Collaborate with your team<\/strong>: easily share analysis results, or, as a senior team member, check work of junior analysts by viewing recordings of their analysis sessions.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Scale as you need<\/strong>: as a cloud service, you can easily scale your team, simply by adding more licenses.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>We&#8217;ll show you in an interactive presentation how ANY.RUN can help your security team.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p><a href=\"https:\/\/calendly.com\/d\/3nd-rzd-xvx\/any-run-demo-blog\/\" target=\"_blank\" rel=\"noreferrer noopener\">Get a demo \u2192<\/a>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Threat Intelligence Feeds are an essential part of your cybersecurity perimeter \u2014 if you use this tool correctly, you can increase your chances of detecting an attack \u2014 it&#8217;s like getting near real-time reports about the enemy from the front lines.&nbsp;&nbsp; But do you know how to effectively use and operationalize threat intelligence feeds? Let\u2019s [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":7763,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[57,10,54],"class_list":["post-7757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifehacks","tag-anyrun","tag-cybersecurity","tag-features"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Use Threat Intelligence Feeds - ANY.RUN&#039;s Cybersecurity Blog<\/title>\n<meta name=\"description\" content=\"Learn how to effectively use threat intelligence feeds and understand the difference between commercial and open-source feeds.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jack Zalesskiy\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/\"},\"author\":{\"name\":\"Jack Zalesskiy\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"How to Use Threat Intelligence Feeds\",\"datePublished\":\"2024-05-08T13:04:43+00:00\",\"dateModified\":\"2025-01-31T05:31:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/\"},\"wordCount\":1895,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"features\"],\"articleSection\":[\"Cybersecurity Lifehacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/\",\"name\":\"How to Use Threat Intelligence Feeds - ANY.RUN&#039;s Cybersecurity Blog\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2024-05-08T13:04:43+00:00\",\"dateModified\":\"2025-01-31T05:31:07+00:00\",\"description\":\"Learn how to effectively use threat intelligence feeds and understand the difference between commercial and open-source feeds.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Lifehacks\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How to Use Threat Intelligence Feeds\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"Jack Zalesskiy\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image1-min-1-1-1-1.webp\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image1-min-1-1-1-1.webp\",\"caption\":\"Jack Zalesskiy\"},\"description\":\"Jack Zalesskiy is a technology writer with five years of experience under his belt. He closely follows malware incidents, data breaches, and the way in which cyber threats manifest in our day-to-day lives.\",\"url\":\"#molongui-disabled-link\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Use Threat Intelligence Feeds - ANY.RUN&#039;s Cybersecurity Blog","description":"Learn how to effectively use threat intelligence feeds and understand the difference between commercial and open-source feeds.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/","twitter_misc":{"Written by":"Jack Zalesskiy","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/"},"author":{"name":"Jack Zalesskiy","@id":"https:\/\/any.run\/"},"headline":"How to Use Threat Intelligence Feeds","datePublished":"2024-05-08T13:04:43+00:00","dateModified":"2025-01-31T05:31:07+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/"},"wordCount":1895,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["ANYRUN","cybersecurity","features"],"articleSection":["Cybersecurity Lifehacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/","url":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/","name":"How to Use Threat Intelligence Feeds - ANY.RUN&#039;s Cybersecurity Blog","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2024-05-08T13:04:43+00:00","dateModified":"2025-01-31T05:31:07+00:00","description":"Learn how to effectively use threat intelligence feeds and understand the difference between commercial and open-source feeds.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/how-to-use-threat-intelligence-feeds\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Lifehacks","item":"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/"},{"@type":"ListItem","position":3,"name":"How to Use Threat Intelligence Feeds"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"Jack Zalesskiy","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image1-min-1-1-1-1.webp","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/03\/image1-min-1-1-1-1.webp","caption":"Jack Zalesskiy"},"description":"Jack Zalesskiy is a technology writer with five years of experience under his belt. He closely follows malware incidents, data breaches, and the way in which cyber threats manifest in our day-to-day lives.","url":"#molongui-disabled-link"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/7757"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=7757"}],"version-history":[{"count":11,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/7757\/revisions"}],"predecessor-version":[{"id":11351,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/7757\/revisions\/11351"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/7763"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=7757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=7757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=7757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}