What best describes threat feeds in cybersecurity intelligence?

• A. IOC streams used to automate indicators
• B. Public OSINT data
• C. Proprietary threat intel with no automation
• D. Closed-Source intelligence

Answer: (A)

Threat feeds are streams of indicators of compromise designed to be consumed by security tooling to automate detection and response. They deliver actionable IOCs such as IPs, domains, file hashes, URLs, and related TTPs in near real time, so security systems like SIEMs, IDS/IPS, EDR, and SOAR can automatically ingest, correlate, and act—whether that means alerting, blocking, or triggering responses. This automation-focused nature is what makes a threat feed distinct from static reports or finished intelligence; the feed format enables ongoing, hands-off protection as new threats emerge. Public OSINT data can contribute to threat intelligence, but it isn’t by itself a threat feed designed for automated ingestion. Proprietary threat intel that offers no automation wouldn’t be a feed, since the defining feature of a threat feed is the automated data stream of indicators. Closed-Source intelligence refers more to access restrictions than to the feed’s functional purpose.