Threat Intelligence Feed Review overview

Evaluates and tunes threat intelligence sources and indicator-of-compromise feeds -- reviewing feed quality metrics including true-positive rate, timeliness, and relevance to organizational threat landscape, deduplicating and normalizing IOCs across commercial, open-source, and ISAC feeds, tuning detection rules and SIEM correlation logic based on feed performance, retiring stale or low-fidelity indicators that generate false positives, assessing coverage gaps against MITRE ATT&CK techniques relevant to the organization, and evaluating emerging threat intelligence vendors. Produces feed quality scorecard, tuning recommendations, and coverage gap report. Excludes incident response and threat hunting.