Your $200K Security Tool Has a STIX Import Button. Here's the Free Feed It's Been Waiting For.

The Button Nobody Clicks

You bought the platform. CrowdStrike, Palo Alto, Microsoft Sentinel, IBM QRadar, OpenCTI - doesn't matter which. Somewhere in the settings, there's a button that says "Add STIX/TAXII Feed."

You've probably never clicked it.

Not because you don't want more threat intelligence. Because when you go looking for feeds to add, you find:

• Vendor's own feed: $50K/year extra
• AlienVault OTX: Still on STIX 1.x (a different format)
• MITRE ATT&CK: Knowledge base, zero IOCs
• abuse.ch feeds: JSON, not STIX
• CINS Army: Plain text IP list
• Everything else: CSV files you'd have to transform yourself

So the button sits there. Waiting.

---

We Went Looking

We spent an afternoon doing what you probably did: searching for free STIX 2.1 threat intelligence feeds.

Here's what we found:

Zero free STIX 2.1 feeds with actionable IOCs and full graph structure.

The enterprise platforms support STIX 2.1 because enterprise customers check that compliance box. But the actual feeds? Paywalled at $50K-$500K/year.

---

Why the Gap Exists

STIX 2.1 is the format. Everyone agrees on it. OASIS published the spec. IBM, Microsoft, Palo Alto, CrowdStrike - they all implemented it.

But here's the thing: threat intelligence is a product. The vendors selling $50K feeds aren't going to give them away. And the open-source community? They're publishing in whatever format is easiest (JSON, CSV, plain text).

1. Collecting IOCs from multiple sources
2. Correlating and deduplicating
3. Enriching with threat actor attribution
4. Adding kill chain phases
5. Building relationship graphs
6. Outputting as proper STIX 2.1 bundles

Until now.

---

What We Built

DugganUSA STIX Feed: https://analytics.dugganusa.com/api/v1/stix-feed

A real STIX 2.1 bundle with:

Sources: AbuseIPDB, VirusTotal, ThreatFox, OTX, plus our own honeypot network.

Cost: Free. Actually free. No API key required.

---

How to Use It

Microsoft Sentinel

Settings → Data Connectors → Threat Intelligence - TAXII
URL: https://analytics.dugganusa.com/api/v1/stix-feed
Polling frequency: 1 hour

OpenCTI

# docker-compose.yml
- TAXII2_URL=https://analytics.dugganusa.com/api/v1/stix-feed
- TAXII2_INTERVAL=3600

CrowdStrike Falcon

Support → API Clients → STIX/TAXII Integration
Discovery URL: https://analytics.dugganusa.com/api/v1/stix-feed

curl (for the skeptics)

curl -s "https://analytics.dugganusa.com/api/v1/stix-feed?days=7" | jq '.objects | length'
# Returns: 2500+

Parameters

---

What You Get

Every indicator includes:

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

{
  "type": "indicator",
  "pattern": "[ipv4-addr:value = '45.148.10.242']",
  "confidence": 95,
  "kill_chain_phases": [
    {"kill_chain_name": "mitre-attack", "phase_name": "command-and-control"}
  ],
  "x_dugganusa_threat_intel": {
    "abuse_score": 100,
    "malware_family": "Cobalt Strike",
    "isp": "TECHOFF-HOSTING",
    "country": "RU"
  }
}

Plus relationship objects linking indicators to threat actors:

{
  "type": "relationship",
  "relationship_type": "attributed-to",
  "source_ref": "indicator--abc123",
  "target_ref": "threat-actor--def456",
  "confidence": 70
}

This isn't a flat list of IPs. It's a graph you can query.

---

Why Free?

Because we're not a threat intel company. We're a security operations company that built this infrastructure for ourselves and realized nobody else was publishing it.

Our business is the $77/month security dashboard at security.dugganusa.com. The STIX feed is what happens when you open-source your data pipeline.

Also: we think threat intelligence being locked behind $50K/year paywalls is part of why security is losing. The attackers share freely. Defenders should too.

---

A Note About Your Palo Alto Invoice

You're paying Palo Alto Networks (or CrowdStrike, or Recorded Future) somewhere between $50K-$500K/year for threat intelligence feeds.

That budget just became available for other things.

We're not saying cancel your contract tomorrow. We're saying: try our feed alongside theirs for 30 days. Compare the IOCs. Check the overlap. See if you're paying $50K for something you can get for free.

Then have a conversation with your CFO about what else that budget could do.

---

The Fine Print

• License: CC0-1.0 (public domain, do whatever you want)
• Attribution: Appreciated but not required
• SLA: Best effort (it's free)
• Rate limits: Don't abuse it
• Format: STIX 2.1 bundle, JSON

---

Try It

Right now. Takes 30 seconds.

curl -s "https://analytics.dugganusa.com/api/v1/stix-feed?days=1" | jq '.objects | group_by(.type) | map({type: .[0].type, count: length})'

Then go click that button in your $200K security platform. It finally has something to import.

---

DugganUSA LLC operates threat intelligence infrastructure from Minnesota at $75/month. We believe in sharing what we learn.

Questions? [email protected]
Dashboard: security.dugganusa.com
Feed: analytics.dugganusa.com/api/v1/stix-feed

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=your-200k-security-tool-has-a-stix-import-button-here-s-the-free-feed-it-s-been-waiting-for-1