Talon ThreatTalon Studio v1.0.2-beta

Threat Feeds

The intelligence sources behind Talon Threat — CISA KEV built in, abuse.ch and other feeds one click away, and your own JSON, CSV, RSS, STIX/TAXII or MISP sources — scoped org-wide or per workspace and versioned in Git.

What they are

Threat Feeds (/threat-intel/feeds) are the intelligence sources that power Talon Threat. Each feed is scoped either to the organisation (shared across every workspace) or to a single workspace, and its configuration is versioned in Git with the rest of your content.

The CISA KEV feed is built in. Its catalogue syncs for the whole appliance as part of the hourly threat-intel loop; the row on this page mirrors that sync's status and entry count, and its Sync button runs the full KEV sync at once. Disabling the row does not stop the KEV sync — use DISABLE_THREAT_INTEL_SYNC for that. Other enabled feeds sync in the same hourly loop.

CISA KEVabuse.chSTIX / TAXIIMISPOrg scopeWorkspace scope

Eight feeds ship built in. At organisation scope only CISA KEV and CISA Advisories are enabled by default; the rest are present but off until enabled:

CISA KEV

The known-exploited vulnerability catalogue. Enabled by default.

CISA Advisories

CISA cybersecurity advisories (RSS). Enabled by default.

GitHub Security Advisories

GitHub's advisory database. When enabled, its CVEs are also mapped to ATT&CK through their CWEs, so advisory rows can show coverage. Disabled by default.

URLhaus (abuse.ch)

Recent malware-distribution URLs. Each becomes an indicator for the URL and its host. Disabled by default.

ThreatFox (abuse.ch)

Recent IOCs, listed as feed entries. Disabled by default.

MalwareBazaar (abuse.ch)

Recent malware samples, listed as feed entries. Disabled by default.

Feodo Tracker C2 IPs

abuse.ch's botnet command-and-control IP blocklist. Each IP becomes an indicator and appears on Infrastructure. Disabled by default.

Ransomware.live Victims

Recent ransomware victim disclosures. Disabled by default.

Managing feeds

Adding, enabling, disabling and removing feeds needs the organisation admin role, in either scope. Any user who is not read-only can press Sync on an enabled feed.

Open /threat-intel/feeds. The Scope toggle (All, Organisation, This workspace) filters the list and decides where a new feed goes; adding while All is selected creates an organisation feed.

Enter a Feed name and URL, pick the type, add the key or token if the type takes one, and click Add.

Organisation feeds are written to Org/threat-feeds.yaml in the organisation's configuration repository; workspace feeds to Talon/threat-intelligence/threat-feeds.yaml in the workspace repository. Each change is staged as a pending change for you to commit.

Press Sync to fetch now, or wait for the hourly loop. Each row shows its entry and indicator counts and when it last synced; a failed sync shows its error on the row.

Talon Threat → Threat Feeds

Adding a feed: name it, give its URL, pick the type, set the scope to Organisation or This workspace — the scope decides which Git repository the YAML is versioned in — then click Add.

HTTP · JSON

A JSON array, or an object holding one (under keys such as data, items, results or vulnerabilities). Common fields — ID, title, summary, severity, URL, date — are picked up by name. Records that carry an IP address also become IP indicators.

HTTP · CSV

A CSV with a header row, read the same way.

RSS / Atom

A syndication feed, like the built-in CISA Advisories source.

STIX / TAXII

A TAXII 2.1 collection URL (OpenCTI collections work); Talon reads its objects endpoint, up to 20 pages or 5,000 objects per sync. Indicators become scored indicators, and vulnerability-to-technique relationships add ATT&CK mappings. The optional token is sent as a Bearer token; for HTTP Basic, set authScheme: basic and authUser in the feed's config in the YAML.

MISP

A MISP instance's base URL and automation key (required). Talon pages through /attributes/restSearch, up to 5,000 attributes per sync; attributes become indicators.

Per-sync limits. Each fetch times out after 20 seconds, and up to 2,000 entries per feed are stored per sync.

Workspace built-ins start disabled. The first time a workspace gets its own copies of the built-in feeds, they start disabled — even CISA Advisories — so opening a new workspace never starts fetching everything. Organisation built-ins keep their normal default.

Built-ins can only be disabled. Only a custom feed can be removed. Removing it hides it at once and stages the YAML without it, but the feed and its encrypted credential are kept until that change is committed. There is no Undo button; for a workspace feed, discarding the pending change before committing restores it.

Private addresses are allowed. A feed may point at a loopback or LAN host, such as an internal MISP or TAXII server; cloud metadata and link-local addresses are always refused. Set TALON_STRICT_OUTBOUND_URLS=true to refuse every private or reserved range.

Feed credentials don't travel in Git

A feed's key or token is encrypted in the database and never written to the YAML, so it does not travel with your commits. After restoring a backup onto a new appliance or re-creating a feed from Git, re-enter feed credentials to resume syncing.

Indicators and how they decay

Four sources produce scored indicators: IP blocklists such as Feodo Tracker, URLhaus, STIX indicator objects from TAXII, and MISP attributes. ThreatFox, MalwareBazaar and advisory feeds produce list entries only. An indicator starts at a base score — 50 by default; a STIX indicator's own score or confidence; for MISP, 80, 60 or 40 by the event's threat level, 20 when the attribute is not flagged for detection; 25 for an offline URLhaus URL — and decays to zero over 30 days, or by a STIX indicator's own expiry. An IP still on a blocklist is refreshed each sync. Talon SOC matches a case's IPs, domains, URLs and hashes against these live scores to flag known-bad observables.