What is a threat feed?
A threat feed is a regularly updated stream of threat data that security tools can consume without a person retyping anything. Most entries are indicators of compromise: IP addresses of command-and-control servers, phishing and malware URLs, domains, and hashes of known malicious files. A firewall, web proxy, DNS resolver, SIEM or EDR platform downloads the feed on a schedule and compares what it sees on the network or on endpoints against the list.
A feed is one product of threat intelligence, not the whole of it. Written advisories and reports explain who is attacking and why; a feed hands tools the specific values to match or block. That makes feeds the most tactical form of intelligence and also the quickest to go stale.
What a feed entry contains
A bare list of addresses is the simplest feed and the least useful. Better feeds attach context to each value so an analyst can decide what a match means:
- Type and value: an IPv4 address, a domain, a URL, a SHA-256 hash or an email sender.
- Category: botnet C2, phishing, malware distribution, scanning or a Tor exit node.
- First seen and last seen: when the value was observed in attacks.
- Confidence or score: how sure the producer is that it is malicious.
- Expiration: when tools should stop acting on it.
Feeds arrive as plain text or CSV files, vendor APIs, or STIX objects delivered over TAXII. A threat intelligence platform (TIP) often sits in the middle, pulling in several feeds, removing duplicates and pushing one scored list to each tool.
Where feeds come from
Open-source and community feeds cost nothing and cover a lot of ground, but nobody checks them against your environment. Commercial feeds come with a subscription and are usually curated, scored and tagged with the malware family or campaign. Government programs such as CISA's Automated Indicator Sharing, and sector groups such as ISACs, distribute indicators to participants. Your own incidents, honeypots and sandbox detonations produce an internal feed that is often the most relevant one you have.
A feed match in practice
A SIEM correlation rule compares proxy logs with a commercial C2 feed and raises this alert:
2026-10-21T03:14:09Z proxy ALLOW src=10.20.4.17 dst=cdn-sync-update.example feed=c2-domains confidence=85 last_seen=2026-10-20
The match says the workstation reached a domain the vendor tied to command-and-control traffic yesterday, with high confidence. The analyst checks the host's EDR timeline, searches DNS logs for the same domain on other machines and, if the evidence holds, isolates the host. Had the entry been last seen eight months ago with a confidence of 30, the same match would deserve far less urgency, because attackers abandon infrastructure and domains change hands.
Running feeds without drowning in them
Every feed adds alerts someone has to review. Before a new feed is allowed to block traffic, run it in alert-only mode for a while and see what it would have stopped. Shared hosting and content delivery network addresses are the classic false positives, since blocking one IP can cut users off from hundreds of legitimate sites. Age entries out so the blocklist doesn't grow forever, and each quarter compare how many alerts a feed produced with how many turned out to be real. Feeds that are late, aimed at another industry or often wrong should be tuned or dropped. The wider job of judging sources by timeliness, relevance, accuracy and confidence belongs to threat intelligence as a whole.
Threat feed on the CompTIA Security+ exam
Threat feeds sit with intelligence sources under SY0-801 objective 2.1, which covers where threat information comes from and how it reaches the people and tools that use it. A scenario that describes automatically loading malicious IPs, domains or hashes into a firewall, proxy or SIEM is describing a threat feed. Clues such as "free" or "community" point to an open-source feed, "paid subscription" to a proprietary one, and peers in the same industry to an ISAC. Common distractors are STIX, which is a format a feed may use rather than the feed itself, TAXII, which is the transport, and a vulnerability scan, which looks for weaknesses in your own systems instead of attacker infrastructure.