Enterprise IOC Feed
2 min
the enterprise ioc feed turns research into proactive defense it strengthens your threat detection and response posture by pushing intelligence directly into your security stack feeds deliver threat intelligence from flare into your existing security tooling (siem, soar, edr, tip, or firewalls) in industry standard stix 2 1 format via the taxii 2 1 protocol the enterprise ioc feed is delivered as two taxii feeds flare cti feed carries the intelligence objects themselves, including indicators, malware, threat actors, campaigns, and the other entity types flare cti relationship feed carries the stix relationships that connect those objects to one another, for example linking an indicator to the malware, campaign, and threat actor it belongs to both feeds use the same configuration they use taxii 2 1, with basic authentication using your flare api key each feed points to its own taxii endpoint and collection, which flare provides for more information, see our intelligence feeds api documentation https //api docs flare io/guides/ioc feeds key features broad ioc coverage support for the core indicator types security teams rely on, such as, domains, urls, ips, file hashes, campaigns, threat actor profiles, and intrusion sets stix/taxii delivery all feeds use stix 2 1 for the intelligence format and taxii 2 1 as the transport protocol this is the industry standard and most siems, soars, tips, and edrs support it natively your existing tooling can consume these feeds without custom integration work stix object relationships indicators are delivered with their full relationship context intact an indicator links to the campaign it belongs to, which links to the threat actor behind it, which links to the associated malware family your tip receives queryable, traversable intelligence, not a flat list programmatic ioc api in addition to the taxii feeds, flare provides a programmatic ioc api this allows you to push indicators directly from flare research into downstream blocking rules without waiting for the next feed poll cycle click through the following product tour to learn how to integrate the enterprise ioc feed into your existing security stack