Threat Intelligence Sources: Evaluate Evidence Before You Act

A detection count is not a confidence score. Ten feeds can repeat one upstream observation, while one specialist source can contribute direct and timely evidence that no other feed contains.

The isMalicious Sources workspace makes this distinction visible. It combines a searchable feed directory with freshness, entity coverage, unique contribution, agreement, and source intelligence. The Patterns view then shows what those sources reveal across the larger corpus.

This follows NIST SP 800-150, which advises organizations to identify threat-information sources, define sharing goals, and make effective use of the resulting information. Source selection and evaluation are part of analysis, not a procurement detail hidden behind the verdict.

Read the Feed Directory as Evidence Context

Each source row describes more than a name. Depending on available telemetry, you can inspect:

• the entity type covered by the source;
• its category, pack, provider, and status;
• the age of the latest update;
• total entities and the IP/domain composition;
• entities uniquely attributed to that feed;
• the share that unique coverage represents;
• a link to the source itself.

Use the filters to narrow by source type, category, pack, or a search term. This matters when the investigation concerns a specific evidence class. A malware hash feed, a domain-abuse list, a CVE source, and a cryptocurrency source answer different questions even if they all contribute to the same report.

Separate Coverage from Contribution

Coverage asks how much data a feed contributes. Unique contribution asks how much of that data only the feed contributes in the current corpus.

A high-volume feed with no unique entities may still be useful for confirmation, resilience, or refresh cadence. A smaller feed with a high unique share may expose a niche that broader sources miss. Neither measure proves correctness by itself.

Use the pair to ask better questions:

• Is this source broad, specialized, or mostly confirmatory?
• Does it add distinct visibility?
• Is its unique coverage relevant to our assets and threats?
• Is the information fresh enough for the decision?
• Can we trace the claim to the original provider?

An echo indicator is a prompt to inspect provenance. It is not an automatic reason to discard the source.

Look for Independent Agreement

Agreement becomes meaningful when the sources are genuinely independent. Several lists can ingest the same upstream feed, copy the same report, or publish the same community submission.

The source-intelligence cards help analysts review multi-source detections and agreement alongside freshness and contribution. Use that context before escalating a Smart Lookup result.

For a high-impact decision, open the source links and inspect what each source actually asserts. One may report historical association, another current malicious activity, and another only a category label. Counting all three as identical “votes” would erase important differences.

Move from Sources to Corpus-Wide Patterns

The former Intelligence workspace now lives in the Patterns tab of Threats. That view aggregates several analytical lenses:

• category and entity distribution;
• multi-source detections;
• leading malware families and threat types;
• active campaigns;
• network-level intelligence;
• vulnerability patterns;
• domain and registration patterns;
• certificate health.

Patterns help you form a hypothesis. They do not prove that a specific entity is malicious. If registration patterns show a change in newly observed domains, use that signal to choose what to investigate, then return to the entity report and its sources.

The Threats dashboard guide shows how to connect patterns with sectors, actors, malware, and victims.

Use a Five-Question Source Check

Before taking a blocking, containment, or escalation decision, ask:

1. Relevance: Does the source speak directly about this entity and the activity we care about?
2. Recency: When did it observe or update the evidence?
3. Provenance: Is it the original observer, a processor, or a republisher?
4. Independence: Do supporting sources rely on separate observations?
5. Actionability: Does the evidence justify the proposed action for this asset and business context?

Record short answers in the alert or case. Another analyst should be able to reproduce the decision without guessing which green or red badge carried the most weight.

Connect Source Quality to the Response Workflow

Use sources throughout the investigation, not only when challenging a verdict:

1. Identify a change in Threats and Patterns.
2. Open the relevant entity through Smart Lookup.
3. Inspect source freshness, contribution, and agreement.
4. Keep related indicators together in a composite report.
5. Send the validated finding to Alerts and Action Center.
6. Preserve the evidence and reasoning in report history or a case.

This sequence avoids two opposite errors: trusting every feed equally and dismissing a finding because only one specialized source observed it.

Make Source Review a Habit

Source quality changes. Feeds go stale, providers change formats, coverage shifts, and a once-distinct list can become an echo of other collections. Use the refresh control and review the directory regularly, especially before relying on a source for automated enforcement.

The practical goal is not to find one perfect feed. It is to understand what each source contributes, where independent evidence agrees, and how the combined intelligence supports a specific decision.