Feedly Threat Intelligence

Score7 out of 10

2 Reviews and Ratings

What is Feedly Threat Intelligence?

Feedly is a threat intelligence platform that enables Cyber Threat Intelligence (CTI) teams to track threats, contextualize actionable information, and deliver tailored intelligence. The platform continuously scans more than 10,000 open-source channels, including government advisories, vendor blogs, vulnerability databases, news sites, social media, and dark-web forums.

Key Capabilities

Real-Time Threat Graph & Entity Extraction: Feedly uses 1,000 machine-learning models that extract unstructured data such as TTPs (Tactics, Techniques, and Procedures), CVEs, and IoCs (Indicators of Compromise), then integrate them into a real-time Threat Graph. The graph maintains relationships across 10M+ articles, 979 threat actors, 300K+ CVEs, 12K+ malware families, 800 TTPs, and 681M+ IoCs.
Ask AI for Threat Analysis: Analysts can query the threat graph using Ask AI, which generates reports and answers specific questions with citations back to original sources. Deep citations trace every response back to its original source, keeping analysts in control.
Configurable Intelligence Feeds: Feedly's AI Feeds address signal-to-noise problems by delivering continuously updated intelligence streams filtered to an organization's specific threat profile: the threat actors targeting a sector, malware families relevant to a tech stack, and vulnerabilities that matter to infrastructure.
Insight Cards: Threat Actor Insights Cards are generated for every identified threat actor and their aliases, created dynamically when new adversaries are discovered and updated in real-time as new information is published. Insight cards consolidate quick, structured context around vulnerabilities, cyberattacks, threat actors, and malware.
STIX 2.1 Output & Ecosystem Integration: Feedly outputs properly formatted STIX 2.1 bundles where threat actors, malware, TTPs, indicators, vulnerabilities, and their relationships are expressed as correct STIX objects that map directly to downstream platforms without transformation or cleanup. The platform supports out-of-the-box integrations with Anomali ThreatStream, Cortex XSOAR, Microsoft Sentinel, and OpenCTI.
MCP Server for Threat Research Workflows: The Feedly MCP Server connects threat-research tools directly to the Real-Time Threat Graph, providing comprehensive, connected intelligence from 10,000+ sources with pre-mapped relationships between actors, campaigns, and vulnerabilities. Tools can pull fresh intelligence directly from the Threat Graph to answer CTI research questions with current data rather than relying solely on fragmented web search.

Audience:

Audience: Cyber Threat Intelligence teams, SOC analysts, incident responders, vulnerability managers, and security leaders requiring structured threat context to support operational decision-making.

Use Cases:

Real-time monitoring of threat actors, malware families, and vulnerability landscapes relevant to specific business sectors or infrastructure.
Automated extraction and normalization of indicators from open-source intelligence to feed threat intelligence platforms (TIPs), SIEMs, and SOARs.
Threat-hunting hypothesis generation based on trending techniques and adversary behavior.
Rapid creation of intelligence briefings and newsletters for internal stakeholders and compliance teams.

Technical Specifications

Source Coverage: 10,000+ open-source channels
Entity Relationships: 10M+ articles, 979 threat actors, 300K+ CVEs, 12K+ malware families, 800 TTPs, 681M+ IoCs
ML Models: 1,000 models for entity extraction and relationship mapping
Output Formats: STIX 2.1, MISP, JSON
API Access: REST API for programmatic access to intelligence feeds, Intel Agents, Ask AI, Insights Cards, and threat-graph relationships
Integrations: Native connectors for Anomali ThreatStream, Cortex XSOAR, Microsoft Sentinel, OpenCTI, Splunk, and custom integrations via API
Language Support: Multilingual analysis