Threat Feed

Overview

The threat feed delivers curated briefs to the platform as signed bundles. Each brief carries a narrative, a set of Sigma rules, IOCs, runbooks, playbooks, MITRE ATT&CK mappings, and metadata about the vendors, products, and operating systems it affects. The platform indexes and scores every brief against your company context so you triage what matters first.

Regulated and air-gapped deployments can upload bundles manually; SaaS deployments receive them automatically over a signed channel.

What a brief contains

• Narrative — what the threat does, who is behind it, how it spreads.
• Suggested rules — Sigma YAML, normalized and deduplicated against your existing library.
• IOCs — domains, IPs, hashes, user agents, with suggested hunting queries pre-generated.
• Runbooks and playbooks — response steps that can move with adopted rules and hunts.
• MITRE mapping — tactics, techniques, sub-techniques. Feeds the threat-model weight.
• Threat actor — free-text actor name on the brief, normalized against the threat-actor catalog on ingest.
• Affected vendors / products / OS — structured lists. Briefs render vendor, product, and OS chips when these fields are populated, so you can scan a feed and immediately see which entries hit your stack.
• CVE enrichment — CVSS, EPSS, and CISA KEV flags ride alongside each brief in a shared metadata index.

Segmented bundles

Bundles are delivered as monthly segments under a single manifest, not as one monolithic file. Each release contains:

• A manifest.json index listing every monthly segment with its checksum, brief count, and last-modified date.
• One segment file per month with that period’s briefs and digests.
• A shared CVE metadata file referenced by every segment, refreshed whenever EPSS/KEV data changes.

The platform downloads the manifest, fetches the segments and CVE metadata in parallel, and merges them into a single state. Incremental updates only touch the segments that changed — old segments are reused from cache. SaaS tenants get this automatically; air-gapped operators sync the manifest and segments together.

The bundle format is backward-compatible with the legacy single-file bundle.json, but new releases use segments by default.

Relevance scoring

Every brief gets a relevance score (0–100) per company. The score blends:

• Industry profile match (finance, healthcare, SaaS, regulated EU, etc.).
• Affected vendor / product / OS overlap with what you actually run.
• MITRE technique overlap with your accepted attack paths.
• Threat actor overlap with actors already pinned to your hunts or detections.
• Watchlist matches — keywords or asset names you’ve explicitly flagged.

A brief’s MITRE techniques are matched against your accepted attack paths: overlapping paths show as related risks and unmatched techniques as coverage gaps you can model in one step. See Risks → Threat-feed relevance . A high score (≥75, or a critical watchlist match) raises a brief’s priority in the feed and the exposure views; it never creates a risk on its own.

Brief customization

When Threat Feed, AI, and Brief Customization are enabled for a tenant, CraftedSignal can generate company-specific context for a brief. The customization uses the tenant’s industry, modeled services, technology stack, and existing detection context to explain why the brief matters and what action is likely useful.

The original brief remains the source of truth. Customized content is tenant-scoped, AI-generated, and reviewable.

The adoption flow

1. Review — narrative, affected vendors/products/OS, MITRE coverage of the brief, and the suggested rules.
2. Adopt a rule in one click: creates a detection in your library linked back to the brief, including any runbook or playbook content carried by the brief.
3. Hunt the IOCs — the brief page generates platform-specific queries from the brief’s IOC list. A Create hunt button turns the generated query into a new hunt immediately. The hunt is pre-populated with:
   • Title: "IOC Hunt: <brief title>".
   • MITRE tactics and techniques pulled from the brief’s TTP list.
   • A backlink to the source brief so you can navigate between the hunt and the brief in both directions.
   • One hunt query carrying the generated IOC query string, marked with source ioc_generated.
4. Watchlist the brief for periodic re-check if it isn’t actionable right now.
5. Dismiss with a reason — the relevance model learns from the dismissal.

Adoption decisions are per-tenant. The same brief can be adopted by one company and dismissed by another without affecting either.

Per-brief dismiss

The dismiss button at /threat-feed/<slug> records a per-company acknowledgement: the brief still exists in the feed, but it disappears from your active queue and your dashboard’s Unactioned briefs counter. Re-open the brief any time to un-dismiss — the acknowledgement is reset and the brief flows back into triage.

Dismissals are tenant-scoped. A SaaS instance with multiple companies tracks one dismissal record per (company, brief) pair.

The dashboard’s intelligence tab

The Intelligence tab on the dashboard is the operations view of the feed. Cards include:

• Actively exploited — briefs flagged as KEV (CISA Known Exploited Vulnerabilities).
• Unactioned briefs (30d) — relevance ≥75 that haven’t been adopted, hunted, watchlisted, or dismissed.
• TI-related open risks — open risks that share techniques with recent high-relevance briefs.
• IOCs in scope and watchlist hits.
• Recently exploited software — the last five briefs naming KEV CVEs, with threat actor and CVSS chips.
• Recent high/critical CVEs — distinct CVE IDs (CVSS ≥7) from the last 30 days, linking back to the originating brief.
• Top briefs — the highest-priority briefs from the last 30 days.

These cards are wired to the same indexes that drive the feed page, so dismissing a brief or adopting a rule updates the dashboard immediately.

Air-gapped delivery

Upload a signed bundle via the dashboard or csctl feed import. The bundle is sealed with your tenant’s public key and will not decrypt outside the environment it was issued for. Segmented bundles work the same way: upload the manifest plus the segments together, and the platform reconstructs the feed locally without any outbound traffic.

See Air-gapped Mode for the full constraint envelope.

Related

• Threat Model — briefs re-weight your risk score.
• Threat Intake — candidate threats queued for SOC review.
• Risks — where briefs relate to your modeled risks.
• Threat Actors — how brief actor strings are normalized into the catalog.
• Library — reusable rule and hunt templates.
• Hunts — IOC queries seed new hunts.
• Rules — adopt a brief’s detection into your library.
• Runbooks & Playbooks — response steps attached to rules, hunts, libraries, and briefs.