What is the McAfee True Intelligence Feed?
The McAfee True Intelligence Feed is a data repository that displays known security threats intelligence that the McAfee Threat Intelligence Service and development teams have evaluated. It displays threat intelligence that has been traditionally used by McAfee products but is now available for public consumption.
What is the purpose of the McAfee True Intelligence Feed?
The primary intent for creating the McAfee True Intelligent feed is to provide value to our customers and the security industry by disclosing more of our research publicly. This content must be available in such a way to be easily consumable and customizable to ones day-to-day job activities.
What can I do with the McAfee True Intelligence Feed?
There are many different ways that the McAfee True Intelligence Feed can be used. However, we expect two primary types of use cases. First, using the main page a user can view the latest threats evaluated by the McAfee Threat Intelligence Service and filter the view by keyword. They will then be able to grab this data in various formats for offline processing. Second, the user can create a customizable RSS feed to plug into their favorite RSS reader. We expect security admins or researchers will use this feature to filter out security threats that do not pertain to them and to get quick notifications to their devices.
Will my favorite RSS reader X work with the McAfee True Intelligence Feed?
The McAfee True Intelligence Feed adheres to the RSS standards and should work with any RSS standard reader.
The main page says it’s showing “1 to 25 of 500 entries”. Are there only 500 entries in your database?
McAfee has more vulnerabilities in our database than can be easily shown from our default view. You can use the search feature or the RSS, JSON, or XML to view more.
How Do I create an RSS feed using the McAfee True Intelligence Feed.
You can access the RSS builder by clicking on “Feeds” from the main page. From here you can choose multiple vendors (by holding control while selecting the vendor name) and filling in any of your desired values. All filters are optional. When you are finished defining the data you want you can click “Generate an RSS Feed URL” button at the bottom. This will generate an RSS feed URL at the top of the page, which you can copy and use in your favorite RSS reader.
How often should I expect data to populate in the feed?
The records displayed in the McAfee True Intelligence feed are populated after the McAfee Threat Intelligence Feed finalizes our evaluation for publishing. It should be publicly viewable shortly after this time. You can expect most of the updates to occur during normal business hours and to have relatively few after hours or on weekends.
What can I use the data from this feed for?
The purpose of this feed is to provide value to our customers and the security industry. Therefor, you are free to use this data to augment your knowledge of various security threats or for use in security research. McAfee fully maintains our copyright interests and ownership of this data. You should not re-distribute this data without our explicit written consent.
Can I build automation tools for this data or use this data in my security product?
You may integrate the True Intelligence Feed with automated tools provided they are not bandwidth or resource intensive. With that said it is strictly forbidden to use this data in a commercial product or for commericial purposes without McAfee’s explicit written consent.