Threat › Module 6 › Lesson 1
Feed Types
Threat feed types literacy — open, commercial, ISAC, sector, internal — catalog rows on YOUR `$TI_LAB` feed inventory stub only.
Visual · t33_feed_types
Feed types = named source categories. $TI_LAB. Original Cyberlium.
Opening
Not every feed fits every team — name feed type rows on YOUR lab inventory before subscribing prod SIEM to stranger data without RoE.
Feed types literacy names: open/community feed category, commercial vendor feed category, ISAC/sector sharing category, internal telemetry-derived feed category, and enrichment vs blocklist feed purpose category. Analyst drafts feed inventory table on `$TI_LAB` instructor stub or YOUR labeled notes — maps five feed types with consumer (SOC, IR, hunting literacy) and handling class — without subscribing employer prod SIEM without ticket, without ingesting unvetted paste-bin IOC dumps, without treating criminal marketplace leaks as 'free feeds.' Cyberlium teaches defender feed vocabulary on YOUR `$TI_LAB` yaml/notes — NOT how to operationalize stolen data. Refused: marketplace IOC cookbooks, unauthorized prod feed enablement, paste-bin bulk ingest without validation. Lab row: feed inventory table five types with consumer and handling stub. chmod 600 under $HOME/cyberlium-lab/t33-ti/.
1. Named feed categories
Open, commercial, ISAC, internal, enrichment vs blocklist — five literacy anchors.
Each row states who consumes it and what handling class applies on YOUR lab stub.
Command guide
Try these commands — Named feed categories
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA feeds — https://www.cisa.gov/topics/cyber-threats-and-advisories FIRST — https://www.first.org/ MISP feeds — https://www.misp-project.org/misp-modules/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/feeds/feed-types-named.txt" <<'EOF'
TI feed types — NAMED LITERACY:
Open source: CISA advisories, vendor blogs, ISAC bulletins
Commercial: paid TI subscriptions (org-authorized contracts only)
Community: MISP sharing circles, ISAC peer exchange
Internal: SOC tickets, honeypot logs, IR case artifacts (YOUR org)
Format: STIX/TAXII, CSV, MISP JSON, custom — normalize before ingest
Lab: document feed types — ingest YOUR iocs.json only, not stranger feeds without auth
EOFCommand — copy this
grep -E 'Open source|STIX|TAXII|org-authorized' "$TI_LAB/feeds/feed-types-named.txt" curl -sS https://www.cisa.gov/topics/cyber-threats-and-advisories | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: CISA feeds (https://www.cisa.gov/topics/cyber-threats-and-advisories); FIRST (https://www.first.org/); MISP feeds (https://www.misp-project.org/misp-modules/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Inventory discipline
Catalog source name, update cadence literacy, trust tier stub, and retention note.
Link Module 5 mapping rows — feeds feed ATT&CK coverage gaps literacy.
3. $TI_LAB boundary
YOUR notes and instructor yaml stubs only — not employer prod feed admin without RoE.
Refused: marketplace leak feeds, unvetted paste-bin bulk ingest, stranger tenant subscriptions.
4. What you ship: feed types inventory table
Five feed type rows + consumer + handling stub + NEVER marketplace feed line.
5. What you record before the next lesson
Feed types inventory table path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Subscribe employer prod SIEM to unvetted paste-bin IOC dump as 'open feed research.'
Right
Feed types inventory from `$TI_LAB` stub. Next: STIX/TAXII Named.
Mission: feed types inventory table
1) Name five feed type categories. 2) Consumer stub per type. 3) Handling class per row UTC. 4) Write NEVER marketplace leak feed line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ISAC feed — minimum handling literacy?”
Knowledge Check
APPLY: Feed types literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Criminal marketplace leaks are course feed sources.
True or False
Knowledge Check
APPLY: Feed inventory includes:
Multiple choice