Skip to main content

Case Study

A documented OpenCTI and firewall feed requirement

An anonymized requirement: ingest intelligence into two OpenCTI instances and prepare hourly firewall TXT updates within an approximate 600,000-IP capacity.

← All case studies

Regional Network Operator

Telecommunications & Infrastructure

600 000
Approximate client IP capacity
1 h
Requested refresh cycle
2
Planned OpenCTI instances

The problem

The client stated a firewall capacity of about 600,000 IP addresses, two self-hosted OpenCTI instances and an hourly TXT refresh. The question: which indicators fit that capacity, and what do they add to existing blocklists and internal intelligence?

Client stack

  • Two self-hosted OpenCTI instances in the stated requirement
  • STIX/TAXII 2.1 ingestion proposed for OpenCTI
  • Customer-operated TXT generation and distribution to firewalls
  • Requested hourly polling and export schedule

Proposed configuration

TAXII collections such as malicious-ips and c2-indicators, with OpenCTI-compatible authentication. A full pull follows every pagination cursor; date filters serve incremental reads. Selection, exceptions, TXT generation and firewall updates stay in the client workflow.

Limits to verify

  • Documents an evaluation need, not a measured security gain or a confirmed production rollout.
  • Presence in a feed does not confirm malicious activity: test scores, exceptions and analyst review before blocking.
  • Source dates can be missing, and a new import does not make an old indicator recent.
  • The 600,000-IP figure is a client constraint, not a public quota or a guaranteed feed size.

Evaluation criteria

Agree a representative sample, compare it with current sources, confirm import and pagination in OpenCTI, then measure useful extra indicators and maintenance effort. Set selection and exception rules with the SOC before automating firewall blocking.

Anonymized from June 2026 correspondence and a commercial proposal. Figures are client constraints, not measured results.

Evaluate a comparable integration

Compare a feed with your current sources in OpenCTI or your SIEM. Feeds are included in Pro and Enterprise.

Talk to us

Evaluate a feed in my toolSTIX/TAXII documentation