Guidelines for selecting and disseminating Sekoia.io IOCs from CTI sources

Sekoia.io outlines how its CTI—sourced from 400+ feeds and comprising 8M+ IOCs with a ~0.01% 2023 revocation rate—can be operationalized using STIX 2.1 through native connectors, TAXII 2.1, and APIs, including configurable feeds for source/type filtering, CSV exports, and options to include/exclude expired or revoked indicators. The report details top IOC-contributing sources (e.g., Sekoia exclusive, tria.ge, PhishTank, ThreatFox, MalwareBazaar) and provides practical guidance for disseminating tailored sets of IPs, domains, URLs, and file hashes to SIEMs, firewalls, and EDRs, noting trade-offs between volume constraints and preservation of contextual relationships.