How to Evaluate a Threat Intelligence Feed: Checklist

A threat intelligence feed is only useful if it fits your environment. The wrong one adds noise, false positives, and maintenance work. This checklist covers the criteria that actually distinguish a good feed from a busy one.

If you are still defining terms, read what a threat intelligence feed is first, or compare free vs. paid feeds.

The Evaluation Criteria

Coverage

Does it track the actors, malware families, and sectors that actually target you?

Strong: Sector and region relevant, with named actors and campaigns

Weak: Generic global indicators with no relevance filter

Freshness

How quickly are new indicators published, and how quickly are old ones retired?

Strong: Near real-time publication with automatic expiry

Weak: Manual updates and indicators that never expire

False-positive rate

Does the provider measure and publish its false-positive rate?

Strong: A stated rate, backed by tuning and feedback

Weak: No metric, or a rate that is never disclosed

Context

Are indicators linked to actors, malware, campaigns, and TTPs?

Strong: Linked STIX objects with relationships

Weak: Bare indicator values only

Standards

Does it speak STIX 2.1 and TAXII 2.1?

Strong: Native STIX and TAXII, plus REST

Weak: Proprietary format with no export path

Provenance

Can you trace an indicator back to its original source?

Strong: Full source attribution on every object

Weak: No visibility into where data came from

Validity windows

Do indicators expire, or does stale data accumulate?

Strong: Explicit valid_from and valid_until fields

Weak: Indicators persist indefinitely

Integration

Does it fit your SIEM, EDR, and TIP without custom glue code?

Strong: Pre-built connectors and standards-based delivery

Weak: Bespoke parsing for every destination

Quick Scorecard

Criterion	Why It Matters
Coverage	Relevance beats volume
Freshness	Stale indicators waste analyst time
False positives	Directly drives alert fatigue
Context	Turns a value into a decision
Standards	Avoids proprietary lock-in
Provenance	Enables validation and audit
Validity windows	Prevents blocklist drift
Integration	Determines time to value

Red Flags

No expiry: indicators that never retire guarantee false positives over time.
No context: bare IOC lists push all the correlation work back to your team.
No provenance: if you cannot trace an indicator, you cannot defend it to auditors or peers.
Proprietary format: if it cannot export to STIX 2.1, integration becomes bespoke.
Unmeasured quality: a provider that does not track its false-positive rate is not managing it.

What Good Looks Like

A strong threat intelligence feed publishes indicators with confidence scores and validity windows, links them to actors, malware, and campaigns, exposes everything in STIX 2.1 over TAXII 2.1, and lets you trace each object back to its source. It also lets you filter by relevance, so you are not paying attention to threats that never target you.

Once you have that shape, integration is a configuration task rather than a project. The Threat Landscape API is built this way: two purpose-built streams, one for deep contextual analysis and one for lean indicator ingestion, both over REST and TAXII 2.1.

Next Steps

With a feed selected, move on to integrating it via TAXII, STIX, or API, or see how a platform turns multiple feeds into one prioritized picture.