Free lab · no signup · about 6 minutes
Feed Architect: Build Your Aggregator
A good intelligence programme is decided by what you choose to read. Fast, verified sources catch the urgent things, technique-rich research feeds detection, and a few strategic sources keep leadership ahead of trends.
You have 45 minutes a day. Pick from 24 source types, file them into folders, then watch a two-week season of events play out: an exploited VPN flaw, a supplier on a leak site, a viral fake zero-day, a new regulation. Each one is caught early, caught late or missed.
New job · first week as the CTI lead
You get 45 minutes a day to read intelligence. Build the aggregator that makes those minutes count, then see how it does over a two-week season.
The rules
Every source costs reading minutes a day and has a signal rating, a typical latency, coverage of the tactical, operational and strategic levels, and a verification level.
File each pick in a folder. Unsorted sources cost 2 extra minutes a day (tab-hopping), and a source in a folder that does not match its topics costs 1.
Over budget, things sit unread: early catches become late, late ones become misses. An unverified-only feed will send you chasing false claims.
Synthetic training data: the sources are generic descriptions and every event, latency and rating is invented for teaching.
How the three levels of intelligence work
Each level needs different sources, which is why one feed is never enough. Tactical intelligence (indicators and exploited flaws) is about speed: it is worth most in its first day, so it should come from fast, narrow, verified sources such as your vendors’ advisories and a known-exploited list, ideally piped straight into tools rather than read.
Operational intelligence (how attackers work) is about depth. Vendor and incident-response research is slower to publish but explains the steps of an intrusion in enough detail to write a detection. A week late is fine; a missing technique is not.
Strategic intelligence (trends, motives, regulation, geopolitics) is about judgement. Landscape reports, your regulator and sector peers tell the CISO where to invest. It changes slowly, so a few good sources beat many noisy ones.
The trap is filling the budget with broad, slow or unverified sources that feel busy. News and social chatter are fast but secondary or unconfirmed: they work as tips only when you also follow a primary source to check them against.
Why folders matter
Reading twenty sources in twenty tabs means a context switch with every one, and each switch leaves some attention behind on the last task. One aggregator with topic folders lets you read all the vulnerability items together, then all the ransomware items, and pivot between sources that cover the same story. The game charges switching minutes for unsorted and misfiled sources to model that cost.
Questions
What is a CTI aggregator?
A single place, usually an RSS reader, that pulls every threat intelligence source you follow into one pane: government advisories, vendor research blogs, independent researchers, news, ISAC bulletins and machine-readable feeds. Sources are grouped into folders such as Daily CTI checks, Vulnerabilities, Ransomware, Cloud, Actor tracking and Sector threats, so an analyst can read by topic instead of hopping between tabs. Free RSS readers are enough to build one.
Which threat intelligence sources should a small team follow first?
Start with the fast, verified, narrow sources that drive action: your own vendors’ security advisories, a known-exploited vulnerabilities list and your national cyber agency’s advisories. Add one or two vendor research blogs for attacker techniques, your sector’s ISAC if you can join, and one strategic source for trends. Add news and social chatter last, and only with a verified source to check claims against.
How do you measure whether a threat intel feed is worth reading?
Compare what it costs in reading time with what it gives: how often it carries something you act on (signal), how quickly it publishes (latency), which level it covers (tactical, operational or strategic), and how far you can trust it without checking. A feed that only repeats what a faster primary source already said is a cost with no benefit.
Are the sources in the game real?
The catalogue uses generic descriptions, not real products. The two government entries describe what those agencies really publish (advisories and a known-exploited vulnerabilities catalogue). Latencies, signal ratings and the season’s events are synthetic training data chosen to show the trade-offs.
Keep going
- Intel Inbox: triage the firehose your aggregator produces, against the clock.
- Pivot Board: pivot one indicator across reports into a campaign and a CISO brief.
- Threat Intel Feed: a curated feed of real vendor research on APT and ransomware groups.
- APT Naming Rosetta Stone: match the many vendor names for the same threat actor.
- Threat Hunt Plan Review: turn operational intel into a hunt plan that holds up.
Further reading: Kraven Security, “Stop Drowning in Data: Build Your Own CTI Aggregator for Free”, on building a free RSS aggregator for CTI.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.