Threat intelligence feeds in Cybersecurity - Mini Project: Build & Apply

Understanding Threat Intelligence Feeds

📖 Scenario: You work in a cybersecurity team that wants to improve its ability to detect and respond to cyber threats. Your team decides to use threat intelligence feeds to get updated information about known malicious IP addresses, domains, and file hashes.

🎯 Goal: Build a simple structured list of threat intelligence feeds, configure a filter for critical threat levels, apply the filter to select relevant feeds, and finalize the list for monitoring.

📋 What You'll Learn

Create a list of threat intelligence feeds with exact names and threat levels

Add a variable to set the minimum threat level to filter feeds

Use a list comprehension to select feeds meeting or exceeding the minimum threat level

Add a final step to prepare the filtered feeds list for monitoring

💡 Why This Matters

🌍 Real World

Threat intelligence feeds help cybersecurity teams stay informed about current threats by providing updated lists of malicious indicators like IPs and domains.

💼 Career

Understanding how to manage and filter threat intelligence feeds is essential for cybersecurity analysts and engineers to prioritize and respond to threats effectively.

1

Create the initial list of threat intelligence feeds

Create a list called feeds containing these exact dictionaries with keys 'name' and 'threat_level': {'name': 'FeedA', 'threat_level': 3}, {'name': 'FeedB', 'threat_level': 5}, {'name': 'FeedC', 'threat_level': 2}, {'name': 'FeedD', 'threat_level': 4}.

Cybersecurity

# Create the list of threat intelligence feeds with exact entries
# Your code here

Hint

Use a list with dictionaries. Each dictionary must have keys 'name' and 'threat_level' with the exact values given.

2

Set the minimum threat level for filtering

Create a variable called min_threat_level and set it to the integer 4 to filter feeds with threat levels 4 or higher.

Cybersecurity

feeds = [
    {'name': 'FeedA', 'threat_level': 3},
    {'name': 'FeedB', 'threat_level': 5},
    {'name': 'FeedC', 'threat_level': 2},
    {'name': 'FeedD', 'threat_level': 4}
]
# Set the minimum threat level to 4
# Your code here

Hint

Just create a variable named min_threat_level and assign it the value 4.

3

Filter feeds by minimum threat level

Create a new list called filtered_feeds using a list comprehension that includes only feeds from feeds where the 'threat_level' is greater than or equal to min_threat_level.

Cybersecurity

feeds = [
    {'name': 'FeedA', 'threat_level': 3},
    {'name': 'FeedB', 'threat_level': 5},
    {'name': 'FeedC', 'threat_level': 2},
    {'name': 'FeedD', 'threat_level': 4}
]
min_threat_level = 4
# Create filtered_feeds with feeds having threat_level >= min_threat_level
# Your code here

Hint

Use a list comprehension with for feed in feeds and an if condition checking feed['threat_level'] >= min_threat_level.

4

Prepare the filtered feeds list for monitoring

Assign the filtered_feeds list to a new variable called monitored_feeds to finalize the feeds that will be monitored.

Cybersecurity

feeds = [
    {'name': 'FeedA', 'threat_level': 3},
    {'name': 'FeedB', 'threat_level': 5},
    {'name': 'FeedC', 'threat_level': 2},
    {'name': 'FeedD', 'threat_level': 4}
]
min_threat_level = 4
filtered_feeds = [feed for feed in feeds if feed['threat_level'] >= min_threat_level]
# Assign filtered_feeds to monitored_feeds
# Your code here

Hint

Simply assign the list filtered_feeds to the variable monitored_feeds.

Practice

1. What is the main purpose of a threat intelligence feed in cybersecurity?

easy

A. To share information about cyber threats to help protect systems

B. To store user passwords securely

C. To monitor employee internet usage

D. To backup data to the cloud

Solution

1. Step 1: Understand the role of threat intelligence feeds

   Threat intelligence feeds provide data about cyber threats like malicious IPs and malware.

2. Step 2: Identify the main goal of sharing this data

   The goal is to help security systems detect and block attacks early.

3. Final Answer:

   To share information about cyber threats to help protect systems -> Option A

4. Quick Check:

   Threat intelligence feeds = Share cyber threat info [OK]

Hint: Feeds share threat data to protect systems quickly [OK]

Common Mistakes:

• Confusing feeds with password storage
• Thinking feeds monitor employee activity
• Assuming feeds are for data backup

2. Which of the following is a common type of data included in threat intelligence feeds?

easy

A. User login credentials

B. Malicious IP addresses

C. Employee contact details

D. Software license keys

Solution

1. Step 1: Identify typical data in threat feeds

   Threat intelligence feeds commonly include data like bad IPs, URLs, and malware info.

2. Step 2: Match the options with typical feed data

   Malicious IP addresses are a key part of threat feeds; others are unrelated.

3. Final Answer:

   Malicious IP addresses -> Option B

4. Quick Check:

   Threat feed data = Malicious IPs [OK]

Hint: Feeds list bad IPs and URLs, not personal or license info [OK]

Common Mistakes:

• Choosing user credentials instead of threat data
• Confusing employee info with threat info
• Selecting software keys which are unrelated

3. Consider this simplified Python code snippet using a threat intelligence feed list:

threat_ips = ["192.168.1.10", "10.0.0.5", "172.16.0.3"]
access_attempts = ["10.0.0.5", "8.8.8.8", "192.168.1.10"]
blocked = [ip for ip in access_attempts if ip in threat_ips]
print(blocked)

What will be the output?

medium

A. ["10.0.0.5", "8.8.8.8", "192.168.1.10"]

B. ["8.8.8.8"]

C. ["10.0.0.5", "192.168.1.10"]

D. []

Solution

1. Step 1: Understand the list comprehension filtering

   The code checks which IPs in access_attempts are also in threat_ips.

2. Step 2: Compare each IP in access_attempts to threat_ips

   "10.0.0.5" and "192.168.1.10" are in threat_ips; "8.8.8.8" is not.

3. Final Answer:

   ["10.0.0.5", "192.168.1.10"] -> Option C

4. Quick Check:

   Blocked IPs = Matching threat IPs [OK]

Hint: Filter access IPs by threat list membership [OK]

Common Mistakes:

• Including IPs not in threat list
• Confusing order of IPs
• Ignoring list comprehension logic

4. A security analyst wrote this code to check if a URL is in a threat feed list:

threat_urls = ["malicious.com", "badsite.net"]
url = "Malicious.com"
if url in threat_urls:
    print("Threat detected")
else:
    print("Safe")

Why does it print "Safe" even though the URL looks like a threat?

medium

A. Because the URL variable is misspelled

B. Because the list is empty

C. Because the print statement is incorrect

D. Because string comparison is case-sensitive and "Malicious.com" != "malicious.com"

Solution

1. Step 1: Check string comparison behavior in Python

   Python compares strings exactly, including case differences.

2. Step 2: Compare "Malicious.com" with "malicious.com"

   They differ in uppercase 'M' vs lowercase 'm', so condition fails.

3. Final Answer:

   Because string comparison is case-sensitive and "Malicious.com" != "malicious.com" -> Option D

4. Quick Check:

   Case-sensitive match needed = Causes "Safe" output [OK]

Hint: Remember string matches are case-sensitive by default [OK]

Common Mistakes:

• Assuming case-insensitive match automatically
• Thinking list is empty
• Blaming print statement syntax

5. A company wants to combine two threat intelligence feeds: one with malicious IPs and another with suspicious URLs. Which approach best helps create a single feed for automated blocking?

hard

A. Merge both lists into a dictionary with keys as 'IP' or 'URL' and values as the threat data

B. Store both feeds as separate plain text files without any structure

C. Ignore one feed and use only the IP list for simplicity

D. Convert all URLs into IP addresses before merging

Solution

1. Step 1: Understand the need to combine different threat data types

   IPs and URLs are different data types; combining them requires clear structure.

2. Step 2: Evaluate merging methods

   Using a dictionary with keys like 'IP' or 'URL' keeps data organized and usable for automated tools.

3. Step 3: Reject unsuitable options

   Plain text files lack structure; ignoring feeds loses data; converting URLs to IPs is unreliable.

4. Final Answer:

   Merge both lists into a dictionary with keys as 'IP' or 'URL' and values as the threat data -> Option A

5. Quick Check:

   Structured merge = Effective combined feed [OK]

Hint: Use structured data (dictionary) to combine different threat types [OK]

Common Mistakes:

• Using unstructured plain text files
• Ignoring one feed reduces protection
• Trying to convert URLs to IPs incorrectly