threat-intel-feed

Curated, high-confidence IOCs (IPs, domains, URLs, file hashes) in ready-to-import formats for firewalls, EDR/XDR and SIEM/SOAR. Updated every 2 hours · last build 2026-10-26 23:24 UTC.

critical 90–100high 75–89medium 50–74

📘 Integration guide (PDF) · Markdown · GitHub repo · Changelog

Feeds

feeds/

metadata.json

feeds/edr/cortex-xdr/

iocs.csv

feeds/edr/crowdstrike/

feeds/edr/eset/

feeds/edr/microsoft-defender/

feeds/edr/sentinelone/

feeds/edr/trendmicro/

suspicious-objects.csv

feeds/firewall/checkpoint/

ioc-feed.csv

feeds/firewall/cisco/

feeds/firewall/fortinet/

feeds/firewall/paloalto/

feeds/firewall/sophos/

feeds/firewall/suricata/

suricata.rules

feeds/generic/csv/

feeds/generic/stix/

stix21.json

feeds/generic/txt/

feeds/siem-soar/microsoft-sentinel/

feeds/siem-soar/splunk/

feeds/siem-soar/wazuh/

Legacy paths (latest/, compatibility mirror)