Automating threat intelligence means receiving indicators in a structured format, filtering them against what you actually run, and triggering a defined action, with humans reviewing the exceptions. NIST SP 800-150 gives the sharing rules and STIX gives the data format, and both apply to financial firms as to anyone else.
What counts as threat intelligence?
NIST's guide defines cyber threat information as "any information that can help an organization identify, assess, monitor, and respond to cyber threats". It includes indicators of compromise, the tactics, techniques and procedures used by threat actors, suggested actions to detect, contain or prevent attacks, and findings from incident analysis. The guide covers how to set sharing goals, find sources, scope activities, write rules for distribution and join existing sharing communities.
Financial firms have an incentive to share: the same criminal groups target many institutions with similar methods, so one firm's finding can protect another.
What is STIX, and why does it matter for automation?
STIX, the Structured Threat Information Expression language, is described by its maintainers as "a language and serialization format used to exchange cyber threat intelligence". It is open source. STIX 2.1 defines 18 domain objects, including Indicator, Malware, Campaign, Attack Pattern, Intrusion Set and Course of Action, connected by relationship objects, and it can be stored as JSON so machines can read it.
Without a shared format, intelligence arrives as emailed PDFs that an analyst retypes into tools. With one, an indicator can flow into a blocking or detection system within minutes.
What can be automated safely?
Automate the mechanical steps.
Ingest from feeds and sharing communities in a structured format.
Deduplicate and age out indicators, since stale ones create false alarms.
Match indicators against your own logs and asset inventory, so a report about a product you do not run drops to the bottom.
Enrich with context, such as what an indicator is linked to.
Open tickets or apply low risk, reversible controls, for example adding a domain to a watch list.
What should stay manual?
Decisions with business consequences. Blocking a payment partner's address range, taking a customer facing system offline, or notifying a regulator are not machine decisions. Define in advance which actions are automatic, which need approval, and who approves.
Quality control also stays human. Check how reliable each source has been, and track how many of its indicators led to something real.
What sharing rules should you set?
NIST's guide stresses rules that control publication and distribution. Decide what you will share, with whom, and what must be removed first, such as customer data or internal host names. Agree handling labels with partners. Legal review of sharing agreements takes longer than the technical work, so start early. We could not fetch a financial sector body's current rules for this article, so check your own sector community's terms.
A constructed example
A regional bank joins a sharing community and ingests its indicator feed. It loads indicators into its detection system with a thirty day expiry, and matches domains against proxy logs. In the first month, one indicator matches a workstation that contacted a listed domain. The system opens a ticket, tags the device and alerts the on call analyst, who confirms and isolates it. The automation found the match, and the analyst made the call.
How to check or apply this
- Define goals: which threats and which assets the intelligence should protect.
- Choose sources and a structured format, such as STIX 2.1.
- Write sharing rules covering what you share, with whom and what you remove.
- Build ingestion with deduplication, expiry and matching against your inventory.
- List which actions are automatic and which need approval.
- Track outcomes: matches, confirmed findings, and false positives per source.
Safeguard's zero day discovery and watch features cover vulnerabilities in the software you depend on, which is one input to a broader intelligence program.
Quick check
What is STIX?
An open language and serialization format for exchanging cyber threat intelligence, often stored as JSON.
Should blocking actions be fully automatic?
Only low risk, reversible ones. Actions that affect customers or partners should need human approval.
Sources
Last reviewed: 18 October 2026.
