Intelligence
What is Threat feed?
A subscription stream of indicators and reports about current attacker activity.
A threat feed is a regular stream of threat data, usually indicators such as IPs, domains, URLs and hashes, sometimes with short context. Feeds come from vendors, information-sharing groups, open-source projects and government agencies.
A feed is raw material, not intelligence. Its value depends on relevance, freshness and false positive rate, and it is most useful when it is filtered against the organisation's own exposure before anything is blocked automatically.