Who Consumes Threat Intel? A Complete Integration Matrix

The Feed Formats

---

Category 1: SIEMs

---

Category 2: Firewalls & Network Security

---

Category 3: EDR / XDR

YARA Integration Example:
```bash
curl -s https://analytics.dugganusa.com/api/v1/detection-rules/yara \
-o /opt/yara-rules/dugganusa.yar

---

Category 4: SOAR Platforms

XSOAR Playbook Example:
``python
def enrich_indicator(indicator):
response = demisto.executeCommand('http', {
'method': 'GET',
'url': f'https://analytics.dugganusa.com/api/v1/search?q={indicator}'
})
return response
``

---

Category 5: Threat Intel Platforms (TIPs)

MISP Import:
``bash
# Add as MISP feed
curl -X POST https://misp/feeds/add \
-H "Authorization: YOUR_API_KEY" \
-d '{
"name": "DugganUSA Threat Intel",
"provider": "DugganUSA LLC",
"url": "https://analytics.dugganusa.com/api/v1/stix-feed",
"source_format": "stix2"
}'
``

---

Category 6: Email Security

Domain Extraction:
``bash
# Extract domains from STIX feed
curl -s https://analytics.dugganusa.com/api/v1/stix-feed?format=json | \
jq -r '.objects[] | select(.type=="domain-name") | .value' \
> malicious_domains.txt
``

---

Category 7: DNS Security

Pi-hole Integration:
```bash
# Add to /etc/pihole/custom.list
curl -s https://analytics.dugganusa.com/api/v1/stix-feed?format=json | \
jq -r '.objects[] | select(.type=="domain-name") | "0.0.0.0 " + .value' \
>> /etc/pihole/custom.list

pihole restartdns
```

---

Category 8: Web Proxies / CASB

---

Category 9: Network Detection & Response

Zeek Intel Framework:
``bash
# Convert to Zeek intel format
curl -s https://analytics.dugganusa.com/api/v1/stix-feed?format=csv | \
awk -F',' 'NR>1 {print $1"\tIntel::ADDR\tDugganUSA\t"$3"\t-\t-\tT"}' \
> /opt/zeek/share/zeek/site/intel.dat
``

---

Category 10: Vulnerability Management

CISA KEV Correlation:
``bash
# Our feed includes CISA KEV data
curl -s https://analytics.dugganusa.com/api/v1/stix-feed | \
jq '.objects[] | select(.type=="vulnerability")'
``

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

---

Category 11: Container & Cloud Security

---

Category 12: Malware Analysis / Sandboxes

---

Universal Integration: cron + curl

For anything not listed above:

#!/bin/bash
# /opt/scripts/fetch-threat-intel.sh

echo "Updated at $(date)"
```

Cron (hourly):
``
0 * * * * /opt/scripts/fetch-threat-intel.sh >> /var/log/threat-intel.log 2>&1
``

---

Summary

---

Questions?

• API Docs: https://analytics.dugganusa.com/docs/stix-feed.md
• Dashboard: https://analytics.dugganusa.com/dashboard
• Contact: [email protected]

---

Free for non-commercial use. Commercial use requires attribution to DugganUSA LLC.

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=who-consumes-threat-intel-a-complete-integration-matrix