Your threat feeds, enforced in seconds
Commercial, open source, ISAC or your own research.
STIX, CSV, TXT and JSON, pulled on a schedule and enforced at DNS. Push verdicts from the SOAR.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 16:10:02 | threat | corp-office | update-check.pw | 10.1.9.14 | feed: isac-indicators |
| 2026-09-15 16:10:31 | threat | build-agent | pkg-mirror-cdn.top | 10.40.8.2 | feed: supply-chain-iocs |
| 2026-09-15 16:11:05 | block | corp-office | sinkholed-c2.net | 10.1.9.14 | category: sinkhole |
| 2026-09-15 16:12:40 | threat | corp-office | exfil-data.click | 10.1.9.14 | push: SOAR-4412 |
Intelligence that is not enforced is a report
Feeds arrive in four formats from a dozen sources and end up in a spreadsheet, a ticket or a SIEM watchlist. The indicator is known; nothing stops the connection. Enforcement at the resolver turns every indicator into a block on every device that resolves through the policy.
Feeds in every format
STIX from the vendor, CSV from the ISAC, TXT from the researcher, JSON from the scanner.
Stale entries never expire
A blocklist that only grows blocks a legitimate domain months after the indicator was retired.
No round trip from the SOAR
The analyst confirms the domain; a ticket asks someone to block it next week.
Pull, push, enforce
Register the feed
URL, format, schedule and the list it populates. Each pull records the entries added and retired.
Push from the SOAR
The push API accepts up to a thousand entries per call with confidence, expiry and a case reference.
Enforce on publish
Lists publish to the resolvers on change. Every hit is a threat event with the feed name in the reason.
Threat intelligence controls
Four formats
STIX, CSV, TXT and JSON parsers. One feed per list, pulled on the schedule you set.
Push API
Scoped API key, up to 1,000 entries per request, expiry per entry. Built for SOAR playbooks.
Provenance per entry
Source, reference, confidence and expiry on every indicator. Retired entries leave the list on their own.
Global and inherited lists
MSSP parents push blocks to every tenant. Tenants keep their own lists alongside.
Feed events
The feed.polled webhook reports each pull. A failed pull pages someone before the list goes stale.
Change log
Every list change with its origin. The audit answer to why a domain was blocked on a given day.
Verdict to block in one call
A playbook confirms an indicator and pushes it with a confidence score and a seven day expiry. The next publish enforces it on every site under the policy.
POST /api/v1/gateway/push/{list_uuid}/entries
Authorization: Bearer sk_... (scope: lists:write)
{ "entries": [
{ "value": "exfil-data.click", "confidence": 95, "expires_in": 604800,
"source_ref": "SOAR-4412", "note": "seen in agent egress alert" }
] }Questions teams ask
Which feeds are included?
Securd maintains the security categories. Your feeds are yours: any URL in a supported format. No feed marketplace and no lock-in.
How fast is enforcement after a push?
The change publishes to the resolvers on commit. Verify with a lookup against the pushed name from a governed host.
Can indicators be scoped to one policy?
Yes. A feed populates one list, and a list is bound to the policies you choose.
Enforce your first feed today
Register one feed URL, bind the list to a policy, and watch the threat events arrive.