Live Threat Intelligence Resources¶

This page aggregates the highest-signal free threat intelligence resources for SOC analysts. Bookmark this as your daily threat briefing starting point.

Daily Briefing Sources¶

Government & CERT¶

Vendor Research Blogs¶

OSINT & IOC Feeds¶

Free IOC Sources¶

Premium (Free Tier Available)¶

Vulnerability Intelligence¶

Vulnerability Feeds¶

Vulnerability Query¶

# Fetch CISA KEV programmatically
import requests
kev = requests.get("https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json").json()
for vuln in kev['vulnerabilities']:
    print(f"{vuln['cveID']} | {vuln['vendorProject']} | Due: {vuln['dueDate']}")

Dark Web Monitoring (Free/OSINT Methods)¶

Ransomware Leak Site Monitoring (via OSINT)¶

Several security researchers maintain indexed/archived versions of ransomware group activity:

Threat Actor Tracking¶

ATT&CK Groups Database¶

MITRE ATT&CK Groups page provides structured TTP data for 130+ threat actors: - Technique mappings per group - Software used - Campaign timeline - References

ATT&CK Group Matrix: https://attack.mitre.org/groups/
ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/

Key APT Group Quick Reference¶

Malware Family Intelligence¶

Malware Analysis Platforms¶

Community & Information Sharing¶

ISACs (Information Sharing and Analysis Centers)¶

Community Forums & Channels¶

• FIRST.org — Forum of Incident Response and Security Teams, global
• Slack: ThreatIntel.org — Analyst community (invite-based)
• LinkedIn Security Groups — Threat intelligence sharing
• Twitter/X: #threatintel, #infosec — Real-time community sharing
• Mastodon: infosec.exchange — Privacy-conscious security community

Regulatory & Compliance Intelligence¶

Building Your Threat Intelligence Program¶

For implementing a structured TI program, see:

1. Chapter 7: Threat Intelligence & Context
2. Detection Query Library — integrate IOCs as detection rules
3. Threat Hunt Hypothesis Library — actor-specific hypotheses
4. Lab 5: LLM Guardrails Eval — AI-assisted TI analysis

Last reviewed: March 2026 | Maintained by Nexus SecOps Contributors