🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Security Information and Event Management (SIEM) › Lesson 7
TEC-CYBE44-06 · Lesson 7 · 12 clock hours · lab

Threat Intelligence Integration

Objective. Students integrate an open-source threat intelligence feed into the SIEM and configure an alert rule that fires when internal hosts communicate with indicators of compromise (IOCs) from that feed.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is Threat Intelligence Integration?

A SIEM (Security Information and Event Management) system collects log data from across your environment—firewalls, endpoints, servers, and more—and correlates that data to surface suspicious activity. On its own, a SIEM can detect anomalies, but it becomes far more powerful when it knows who the bad actors are. That knowledge comes from threat intelligence feeds.

A threat intelligence feed is a stream of indicators of compromise (IOCs)—IP addresses, domain names, file hashes, and URLs—that security researchers have associated with malicious activity. By importing a feed into your SIEM as a lookup table, you give the system a reference list to check every log event against. When a match occurs, you can fire an alert automatically.

Understanding Indicators of Compromise (IOCs)

IOCs are artifacts observed in a network or on a host that suggest a security incident may have occurred or is in progress. Common IOC types include:

For this lesson, you will work with IP-based IOCs from the abuse.ch Feodo Tracker, a free, publicly available feed that tracks botnet C2 infrastructure, including Emotet, Dridex, and similar threats. The feed is published in CSV format and updated regularly.

Feed Ingestion: From CSV to Lookup Table

Most enterprise-grade and open-source SIEM platforms (Splunk, Elastic SIEM, IBM QRadar, and others) support lookup tables—structured reference files that a search query can join against in real time.

The general workflow for feed ingestion is:

1. Download the current Feodo Tracker CSV from the abuse.ch website. Note the file date; you will need it to verify freshness.

2. Inspect the file. Confirm which column holds the destination IP address and note any metadata columns (first-seen date, malware family, confidence level).

3. Import the CSV into the SIEM as a named lookup table (e.g., `feodo_ioc_list`).

4. Write a cross-reference search query that joins your firewall destination IP field against the lookup table. In most SIEM query languages, this resembles a lookup or enrichment command:

5. Verify the query returns results only when destination IPs actually appear in the feed.

Be careful with field naming. A mismatch between the log field name and the lookup table column name is the most common reason a query returns zero results when you expect matches.

Building a Correlation Rule

A correlation rule (also called a detection rule or alert rule) automates the search query so that the SIEM continuously evaluates incoming logs without human intervention. When the rule condition is satisfied, the SIEM generates an alert at a configured severity level.

For this lab, your rule should:

Testing the Rule

After saving the rule, inject a simulated firewall log entry that contains a destination IP you know is present in the current feed. Confirm the alert fires. Then inject a clean log entry with a destination IP that is not in the feed. Confirm the alert does not fire. Both tests are required to validate the rule.

IOC Lifecycle: Freshness and Expiry

Threat intelligence is perishable. An IP address used as a C2 server today may be taken down, reassigned to a legitimate hosting customer, or repurposed by a different threat actor within days or weeks. Failing to retire stale IOCs leads to alert fatigue—analysts receive large volumes of false-positive alerts, begin to ignore them, and may miss real incidents buried in the noise.

A sound IOC lifecycle process includes:

1. Regular feed refresh: Schedule an automated pull of the latest feed on a cadence that matches the feed publisher's update frequency. For Feodo Tracker, check the site for their published update interval and automate accordingly.

2. Age-based expiry: Set a maximum age for IOCs. Any indicator older than your defined threshold (for example, 30 or 90 days, depending on your organization's risk tolerance) should be removed from the active lookup table unless re-confirmed by another source.

3. Confidence scoring: Where feed metadata includes a confidence or severity score, use it to prioritize alerts. Low-confidence, old IOCs may be demoted to informational rather than high-severity.

4. Documentation: Log every feed update, including the date, number of entries added, and number expired. This record supports audits and incident investigations.

Safety and Professional Practice Notes

When downloading external threat intelligence data, do so only on authorized lab systems or isolated environments. Never import unvetted external data into a production SIEM without reviewing it first—a malformed or malicious CSV could affect SIEM performance or, in rare cases, exploit parsing vulnerabilities. Always verify the source URL against the official abuse.ch site before downloading. In a workplace setting, follow your organization's change-management and data-handling policies before modifying any production lookup table or detection rule.

Key terms10

SIEMSecurity Information and Event Management — a platform that aggregates, normalizes, and correlates log and event data from across an IT environment to detect and alert on security incidents.
Indicator of Compromise (IOC)An artifact—such as a malicious IP address, domain, file hash, or URL—that suggests a host or network may have been compromised or is communicating with a threat actor.
Threat Intelligence FeedA regularly updated data stream of IOCs and associated context, produced by security researchers or organizations and used to enrich SIEM detection capabilities.
Lookup TableA structured reference file (often CSV) imported into a SIEM so that search queries and correlation rules can join live log data against it in real time.
Correlation RuleAn automated detection logic statement within a SIEM that continuously evaluates incoming events and generates an alert when defined conditions are met.
Alert FatigueA condition in which analysts receive so many alerts—many of them false positives—that they become desensitized and may overlook genuine security incidents.
IOC LifecycleThe process of ingesting, validating, aging, and retiring indicators of compromise to keep threat intelligence accurate and actionable.
Command-and-Control (C2) ServerA remote server operated by a threat actor to issue commands to and receive data from compromised hosts (bots) on a victim network.
False PositiveAn alert that fires on benign activity because the detection logic incorrectly identifies it as malicious—commonly caused by stale or overly broad IOCs.
Feed FreshnessA measure of how current a threat intelligence feed is; stale feeds contain outdated IOCs that are no longer associated with active threats, increasing false-positive rates.
In class: Feed ingestion lab: students download a current open-source IP reputation list (e.g., abuse.ch Feodo Tracker) in CSV format, import it into the SIEM as a lookup table, and write a search query that cross-references firewall destination IP logs against the list. · IOC alert rule: students build a correlation rule that triggers a high-severity alert when any internal host initiates an outbound connection to an IP on the imported threat list; rule is tested by injecting a simulated firewall log entry matching a known IOC. · IOC lifecycle discussion and written response: students read a one-page scenario describing stale IOCs causing alert fatigue; they write a half-page response outlining a process for regularly refreshing the threat feed and expiring outdated indicators.
Materials: SIEM instance, abuse.ch Feodo Tracker CSV (public, free), firewall log sample dataset, lab workbook, CySA+ study guide (threat intelligence and vulnerability management chapters)
Check: Rule fires on injected IOC log entry; rule does not fire on clean log entries; lookup table shows current feed date. Written response submitted. Pass = rule functions correctly AND written response addresses feed refresh and expiry.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Security Operations / Threat Intelligence
1. A student imports the Feodo Tracker CSV into the SIEM as a lookup table but the cross-reference query returns zero matches even when a firewall log clearly shows a destination IP present in the CSV. What is the most likely cause?
Threat and Vulnerability Management
2. Which of the following best describes why stale IOCs in a threat intelligence feed can harm a security operations team?
Security Operations
3. When testing a newly created correlation rule, a student injects a log entry containing a destination IP that is in the IOC lookup table. The alert fires. The student then injects a log entry with a clean destination IP. What should happen next to confirm the rule is working correctly?
Threat and Vulnerability Management
4. An analyst sets an IOC expiry policy so that any indicator older than 90 days is removed from the active lookup table. Which security benefit does this policy primarily provide?
Network Security
5. Which internal IP address range should a correlation rule monitor as the source of outbound connections when looking for internal hosts communicating with C2 servers?
Threat and Vulnerability Management
6. A security analyst is reviewing the IOC lifecycle process. Which action best supports maintaining feed accuracy over time?
Threat Intelligence
7. The Feodo Tracker feed is best described as which type of threat intelligence source?
Security Operations / Incident Response
8. When a SIEM correlation rule fires on a confirmed IOC match, the alert should include which of the following details to best support an analyst's initial triage?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →