I built a small project to help make threat intel feeds more usable in practice:
One challenge when navigating through these high-quality threat intel github repos such as Netskope and Palo Alto Unit 42 were that they provide data in formats that aren’t directly usable for detection engineering, SIEM ingestion, or automation pipelines.
This repo focuses on solving that by:
• Taking those raw threat intel feeds
• Extract + structure IOCs
• Make them ready for detection pipelines / automation
The goal is to help security engineers and analysts spend less time cleaning data and more time actually using it for detections and response.
Would love feedback or ideas on what sources/features to add next!