Feed Types
Threat feed types literacy — open, commercial, ISAC, sector, internal — catalog rows on YOUR `$TI_LAB` feed inventory stub only.
Visual · t33_feed_types
Feed types = named source categories. $TI_LAB. Original Cyberlium.
Not every feed fits every team — name feed type rows on YOUR lab inventory before subscribing prod SIEM to stranger data without RoE.
Feed types literacy names: open/community feed category, commercial vendor feed category, ISAC/sector sharing category, internal telemetry-derived feed category, and enrichment vs blocklist feed purpose category. Analyst drafts feed inventory table on `$TI_LAB` instructor stub or YOUR labeled notes — maps five feed types with consumer (SOC, IR, hunting literacy) and handling class — without subscribing employer prod SIEM without ticket, without ingesting unvetted paste-bin IOC dumps, without treating criminal marketplace leaks as 'free feeds.' Cyberlium teaches defender feed vocabulary on YOUR `$TI_LAB` yaml/notes — NOT how to operationalize stolen data. Refused: marketplace IOC cookbooks, unauthorized prod feed enablement, paste-bin bulk ingest without validation. Lab row: feed inventory table five types with consumer and handling stub. chmod 600 under $HOME/cyberlium-lab/t33-ti/.
1. Named feed categories
Open, commercial, ISAC, internal, enrichment vs blocklist — five literacy anchors.
Each row states who consumes it and what handling class applies on YOUR lab stub.
Command guide
Try these commands — Named feed categories
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: CISA feeds (https://www.cisa.gov/topics/cyber-threats-and-advisories); FIRST (https://www.first.org/); MISP feeds (https://www.misp-project.org/misp-modules/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Inventory discipline
Catalog source name, update cadence literacy, trust tier stub, and retention note.
Link Module 5 mapping rows — feeds feed ATT&CK coverage gaps literacy.
3. $TI_LAB boundary
YOUR notes and instructor yaml stubs only — not employer prod feed admin without RoE.
Refused: marketplace leak feeds, unvetted paste-bin bulk ingest, stranger tenant subscriptions.
4. What you ship: feed types inventory table
Five feed type rows + consumer + handling stub + NEVER marketplace feed line.
5. What you record before the next lesson
Feed types inventory table path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Subscribe employer prod SIEM to unvetted paste-bin IOC dump as 'open feed research.'
- Right: Feed types inventory from `$TI_LAB` stub. Next: STIX/TAXII Named.
Mission: feed types inventory table
1) Name five feed type categories. 2) Consumer stub per type. 3) Handling class per row UTC. 4) Write NEVER marketplace leak feed line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ISAC feed — minimum handling literacy?”
APPLY: Feed types literacy on Cyberlium uses:
APPLY: True or False: Criminal marketplace leaks are course feed sources.
APPLY: Feed inventory includes: