analyzing-threat-intelligence-feeds

Use the taxii2client library to connect to a Collection URL and iterate with as_pages over get_objects. Filter returned bundle objects where type equals indicator, optionally passing an added_after date to limit results.

Map each IOC value to a STIX pattern such as [ipv4-addr:value = '1.2.3.4'] and create an Indicator with the stix2 library, setting pattern_type to stix, a valid_from timestamp, confidence, and labels. Multiple indicators are serialized together as a STIX Bundle.

The supported patterns cover IPv4 addresses, domain names, SHA-256 file hashes, URLs, and email addresses. Each type maps to a specific STIX Cyber-observable Object expression like domain-name:value or file:hashes.'SHA-256'.

Feed quality is scored out of 100 by equally weighting four factors: presence of confidence values, labels, external references, and indicators validated within the last 90 days. Feeds with zero indicators receive a score of zero.

Avoid blocking on indicators with confidence below 50 or stale IOCs older than their TTL, since IPs and domains rotate frequently and may be shared with legitimate services like CDNs. Use detection-only rules for low-confidence indicators.