Features 3 min read

Custom Feeds

Create curated threat feeds with specific entity filters, share them with your team, or export as JSON/RSS.

Custom feeds let you build filtered views of ThreatCluster's intelligence stream. Define the entities you care about, share the feed with your team, and consume it via RSS or JSON from any tool.

Creating a Custom Feed

  1. Navigate to Feeds in the sidebar and click New Feed.
  2. Enter a name for the feed (e.g., "Healthcare Ransomware" or "APT Activity - APAC").
  3. Add one or more entity filters to control what appears in the feed.
  4. Click Save.

Adding Entity Filters

Entity filters determine which clusters show up in your feed. You can filter by:

  • Threat actors -- e.g., LockBit, Volt Typhoon
  • Malware families -- e.g., QakBot, Cobalt Strike
  • Targeted industries -- e.g., Healthcare, Financial Services
  • Targeted regions -- e.g., North America, Southeast Asia
  • CVEs -- e.g., CVE-2024-3094
  • Techniques -- MITRE ATT&CK technique IDs

Add multiple filters to narrow results. Clusters matching any of your filters will appear in the feed.

Tip: Start broad with one or two filters, then refine. You can edit filters at any time without losing the feed's share links or tokens.

How Feed Filtering Works

When a new cluster is created or updated, ThreatCluster checks its extracted entities against all active custom feeds. If any entity in the cluster matches a filter on your feed, that cluster appears in the feed results. Matching is case-insensitive and accounts for known aliases.

Sharing Feeds

Custom feeds support domain-based sharing within your organization.

  • Click Share on any custom feed.
  • All users on your organization's domain can view the shared feed.
  • Shared feeds appear in the Shared with me section of the Feeds page.

To stop sharing, open the feed settings and toggle sharing off.

Note: Sharing respects your organization's access controls. Users outside your org cannot access shared feeds unless you provide them with a feed token.

Feed Tokens for API Access

Feed tokens allow external tools to pull your custom feed data without a browser session.

  1. Open the feed and go to Settings > API Access.
  2. Click Generate Token.
  3. Copy the token and use it in API requests:
GET /api/feeds/{feed_id}?token={your_token}

Tokens do not expire by default but can be revoked at any time from the feed settings page.

RSS and JSON Export

Every custom feed has built-in RSS and JSON endpoints.

RSS

Use the RSS URL to subscribe from any feed reader, SIEM, or SOAR platform:

/api/feeds/{feed_id}/rss?token={your_token}

The RSS feed includes cluster titles, summaries, threat scores, and links back to ThreatCluster.

JSON

Use the JSON endpoint for programmatic access:

/api/feeds/{feed_id}/json?token={your_token}

The JSON response includes full cluster metadata, extracted entities, and article references.

Tip: Many SOAR platforms can poll an RSS or JSON URL on a schedule. Use this to automatically ingest ThreatCluster intelligence into your existing workflows.

Feed Digests

Feed digests deliver scheduled email summaries of your custom feed activity.

  1. Open the feed and go to Settings > Digests.
  2. Choose a schedule: Daily, Weekly (picks a day), or Custom interval.
  3. Add recipient email addresses.
  4. Click Save.

Each digest email contains:

  • New clusters added to the feed since the last digest
  • Notable threat score changes
  • A direct link to the full feed in ThreatCluster

To stop a digest, return to the digest settings and remove it.