Feedly Threat Intelligence

No entries match these filters. Clear filters

1. Credential Leak Dark Web Agent: Monitor exposed accounts (2026-10-27) Oct 27, 2026 · issue 122

   New Credential Leak Dark Web Agent monitors up to five email domains per agent, with password-policy filtering, AI summaries, Insights Cards, Trends tab, and API/CSV export.

   • New integrationAdds the Credential Leak Dark Web Agent, monitoring up to five email domains per agent (including subsidiaries and acquisitions), checking for new matches every 24 hours.
   • Adds password-policy filtering to hide leaks where no password meets the organization's complexity requirements, reducing noise from non-compliant credentials.
   • Adds Credential Leaks Insights Cards showing affected email-and-password pairs, source excerpts, First seen and Status (New or Recycled) fields, and links to associated Threat Actor Insights Cards and Cyberattack Insights Cards.
   • Adds a Trends & Visualizations tab showing how findings change over time, their sources, and which accounts appear most frequently.
   • Supports exporting the Insights Card credential table as CSV (with passwords, if present) or retrieving findings and Insights Card content — including passwords — through the Feedly API.

   +2 more show less

   • Includes findings in Automated Newsletters (without passwords) or via Feedly API (with passwords if present) for distribution to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared., SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions., or TIP tooling.
   • Feedly AI generates a What/So what summary for each matching leak, explaining what the leak contains and why it may matter.

   7 details in Everything

2. docs update Oct 27, 2026 · issue 122
   • New detection Credential Leak Dark Web Agent
3. docs update Oct 8, 2026 · issue 097
   • Updated integration GreyNoise Connector — IoC metadata API enrichment
4. docs update Sep 30, 2026 · issue 090
   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Scope a vulnerability advisory to your actual environment so analysts know exactly which internal products to check before recommending remediation.
   📍Which products and versions in our @tech stack are affected by this advisory? What conditions are required for exploitation, and what must we check internally to establish exposure?
   Monitor third-party supplier incidents and get AI-assessed business impact without re-entering your supplier list each time.
   📍What data breaches, ransomware incidents, and leak-site claims involve our @suppliers?
   Deliver a leadership newsletter that explains why each development matters to your organisation, scoped to your tech stack, suppliers, and tracked threat actors.
   📍Prepare this newsletter for our @security leadership. Using our @company overview, summarize the developments that matter to Northwind. Focus on active exploitation of our @tech stack, incidents at our @suppliers, and activity from our @threat actors. Only connect an article to Northwind's environment when the relevance is direct and specific.
5. Org Profile: Turn "what happened" into "why it matters to us" (2026-09-29) Sep 29, 2026 · issue 090

   Feedly Threat Intelligence adds Org Profile, letting teams capture company context and reference it via @ in AI prompts for tailored risk assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Scope an Intel Agent to your known suppliers and assess each incident's business impact without pasting supplier lists into every prompt.
   📍Step 1: In Org Profile, create a Vendor list item named suppliers (import from a .csv file with up to 1,000 companies). Step 2: In Intel Agents, create a collection prompt: What data breaches, ransomware incidents, and leak-site claims involve our @suppliers? Step 3: Add a column prompt: Using our @company overview, assess the potential business implications of this incident for our organization.
   Assess which systems in your environment are actually exposed by a vulnerability advisory, moving beyond generic CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores.
   📍Step 1: In Org Profile, populate the Tech stack (beta) item with your products and versions. Step 2: Open the vulnerability advisory in Feedly and use Ask AI with: Which products and versions in our @tech stack are affected by this advisory? What conditions are required for exploitation, and what must we check internally to establish exposure?
   Deliver a leadership newsletter that explains threat relevance in business terms, scoped to your tech stack and suppliers, without manual curation each run.
   📍Step 1: In Org Profile, create items: security leadership (Audience), company overview (Company overview), tech stack (Tech stack), suppliers (Vendor list), threat actors (List). Step 2: In Automated Newsletters, set the AI Overview prompt to: Prepare this newsletter for our @security leadership. Using our @company overview, summarize the developments that matter to us. Focus on active exploitation of our @tech stack, incidents at our @suppliers, and activity from our @threat actors. Only connect an article to our environment when the relevance is direct and specific.
   • Adds Org Profile, a shared team workspace to capture organizational context — including Company overview, List, Vendor list (add-on), Audience, Tradecraft, and Tech stack (beta) item types — that Feedly AI uses alongside threat intelligence to produce organization-specific assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports importing List items from .csv files and text items from .md (Markdown) files, with Vendor list supporting up to 1,000 companies.
   • Enables @ references to Org Profile items inside AI prompts (Ask AI, Intel Agents, Report Builder, Automated Newsletters) to inject saved context without re-pasting it each run.
   • Allows Org Profile list items to be used as filters in AI Feed, scoping collection to tracked suppliers, threat actors, or technologies.
   • Adds Tech stack (beta) item type to capture product names and versions, enabling vulnerability advisories to be assessed against an organization's specific technology footprint.

   +2 more show less

   • Adds Vendor list add-on item type to capture suppliers and partners for third-party incident impact assessment.
   • Adds Tradecraft item type to encode sourcing rules, confidence-stating conventions, fact/assessment separation, risk-scoring criteria, and follow-up team routing into reusable prompt context.

   7 details in Everything

6. docs update Sep 18, 2026 · issue 078
   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Verify whether a flagged IP is still live and enumerate its exposed services before blocking, to avoid false positives against reassigned addresses.
   📍In an IoC Insights Card for an IP indicator, click Open in Censys to view the host record — including open ports, running services, TLS certificates, ASN, and the CVEs tab with CVSS scores and KEV membership.
   Pivot across all IoCs attributed to a threat actor at once to identify shared infrastructure without drilling into each indicator card individually.
   📍Open a Threat Actor Insights Card, scroll to the IoC table, and click Open in Censys on any IP row to pivot directly to that host's Censys record — including the Network and Routing panel for ASN, Organization, Routing Prefix, and WHOIS data.
7. docs update Sep 18, 2026 · issue 078

   Feedly Threat Intelligence adds Censys pivot: jump from an IP IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. directly to live host data in Censys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
8. Pivot from an IP IoC to live host data in Censys (2026-09-17) Sep 17, 2026 · issue 078

   Feedly IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Insights Cards now link directly to Censys host data for one-click IP pivot without leaving the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Validate whether a reported IP is still live and check for shared infrastructure before actioning a block.
   📍In Feedly Threat Intelligence, open an IoC Insights Card for any IP indicator, then click Open in Censys to view the live host record, open ports, TLS certificates, and certificate-sharing peers in Censys — no Censys account required.
   Pivot across all IoCs attributed to a threat actor without opening individual cards, useful when triaging a batch of infrastructure indicators.
   📍In Feedly Threat Intelligence, open a Threat Actor Insights Card, scroll to the IoC table, and click Open in Censys on any IP row to jump directly to that host's Censys record.
   • Adds an Open in Censys button to IoC Insights Cards, enabling one-click pivot from a flagged IP to live Censys host data including open ports, running services, TLS certificates, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., and hosting provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends the Open in Censys pivot to the IoC table on Threat Actor and Malware Insights Cards, so analysts can pivot from a full IoC list without opening each individual card.
   • Adds an Open in Censys button to IoC Insights Cards, enabling one-click pivot from a flagged IP to live Censys host data including open ports, running services, TLS certificates, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., and hosting provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

9. docs update Aug 26, 2026 · issue 057

   Feedly Threat Intelligence adds a Splunk Hunting Queries AI Model that auto-collects SPL queries from 5,000 vetted CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. sources.

   ⤢ ⤢ ⤢ ⤢
   • New Splunk Hunting Queries AI Model continuously collects SPL-based hunting queries from vendor blogs, threat reports, GitHub repos, and researcher write-ups across 5,000 vetted CTI sources.
   • CVE Insights Card now surfaces associated Splunk Hunting Queries — download the query and jump to the source article for surrounding context directly from the card.
   • API access lets practitioners pull collected hunting queries programmatically into their detection pipeline.

   3 details in Everything

10. docs update Aug 26, 2026 · issue 057

    Feedly Threat Intelligence now automatically collects Splunk Hunting Queries matching your requirements.

    ⤢ ⤢ ⤢ ⤢
11. Automatically collect Splunk Hunting Queries that match your requirements (2026-08-25) Aug 25, 2026 · issue 057

    Feedly Threat Intelligence auto-collects Splunk Hunting Queries (plus Sigma, YARA, Suricata, Snort, KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly.) via a new AI Model and API.

    ⤢ ⤢ ⤢ ⤢
    • Adds a Splunk Hunting Queries AI Model that continuously extracts and surfaces SPL queries from articles across 5,000 vetted CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. sources, vendor blogs, threat reports, and GitHub repositories.
    • Supports programmatic retrieval of collected hunting queries via the API for direct integration into detection pipelines.
    • Extends detection rule recognition to six formats: Splunk SPL, Sigma, YARA, Suricata, Snort, and KQL (Microsoft Defender and Sentinel), covering network traffic inspection, file and malware matching, and log-based detection.
    • Adds CVE Insights Card integration — when a CVE has an associated Splunk Hunting Query, it can be downloaded directly from the card alongside the source article context.
    • Allows pairing multiple AI Models in an AI Feed to narrow collected queries to specific topics, threats, or malware families.

    5 details in Everything

12. Stay on top of every Custom Intel Agent update Aug 19, 2026 · release notes

    New notifications for Custom Intel Agents, new export format, and expanded cyber attack tagging

    • Adds email and Slack notification settings to any Custom Intel Agent to alert on updates based on monitoring needs
    • Adds a new export format for the Cyber Attack Intel Agent
    • Adds more industry categories for cyber attack tagging

    3 details in Everything

13. docs update Aug 19, 2026 · issue 050

    Feedly Threat Intelligence adds a Suricata Rules AI Model to continuously collect, extract, and export Suricata rules from open-web reporting.

    ⤢ ⤢ ⤢
    • New Suricata Rules AI Model for AI Feeds automatically collects articles containing Suricata rules from 5,000 vetted CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. sources, extracts the rules, and makes them exportable for direct import into detection pipelines.
    • API access allows pulling collected Suricata rules programmatically into a detection pipeline.
    • Feedly Threat Intelligence now recognizes six detection rule formats across open-source reporting: Suricata, Snort, Sigma, YARA, Splunk, and KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly.-based Hunting Queries for Microsoft Defender and Sentinel.

    3 details in Everything

14. docs update Aug 19, 2026 · issue 050

    Feedly Threat Intelligence adds continuous collection of Suricata rules matched to your requirements.

    ⤢ ⤢ ⤢
    • Continuously collects Suricata rules matching user-defined requirements, enabling automated rule harvesting for network detection pipelines.

    1 detail in Everything

15. Continuously collect Suricata rules matching your requirements (2026-08-19) Aug 19, 2026 · issue 050

    Feedly Threat Intelligence adds a Suricata Rules AI Model to continuously collect, filter, and export detection rules from open-source reporting.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Continuously surface new Suricata rules relevant to a specific threat actor or malware family as open-source reporting is published.
    📍In Feedly Threat Intelligence, go to AI Feeds › Create AI Feed, add the Suricata Rules AI Model, then pair it with additional AI Models representing your intelligence requirements (e.g. a specific threat actor or malware family) to filter incoming articles to only those containing matching Suricata rules.
    • Adds a new Suricata Rules AI Model that can be paired with an AI Feed to automatically collect articles containing Suricata rules from 5,000 vetted CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. sources and repositories as new reporting is published.
    • Enables export and programmatic API pull of extracted Suricata rules directly into detection pipelines, IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity., or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. tooling.
    • Extends detection rule AI Model coverage to six formats — Suricata, Sigma, YARA, Snort, Splunk, and KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly.-based Hunting Queries for Microsoft Defender and Sentinel — spanning network traffic inspection, file and malware matching, and log-based detection.

    3 details in Everything

16. changelog Aug 11, 2026 · issue 042

    Feedly Threat Intelligence adds Ask AI Analyze/Research to Custom Intel Agents and Censys lookup to IP Insight Cards

    ⤢ ⤢ ⤢ ⤢
    • Custom Intel Agents now support Ask AI Analyze and Research actions, enabling AI-driven analysis and research workflows within agent configurations.
    • IP Insight Cards gain a Censys lookup, surfacing Censys data directly in the IP context panel.
    • Report Builder adds a progress indicator during generation, making long-running report creation more transparent.

    3 details in Everything

17. Enrich and triage Atlassian security releases in the Vulnerability Intel Agent (2026-08-07) Aug 7, 2026 · issue 037

    Feedly Vulnerability Intel Agent now ingests Atlassian security releases within minutes, with CVE filtering by attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., product, and patch policy.

    ⤢ ⤢ ⤢
    • Adds a Latest Atlassian Security Release filter in the Vulnerability Intel Agent that always points to the most recent Atlassian advisory, eliminating manual updates each cycle.
    • Supports filtering Atlassian CVEs down to specific products in your stack (e.g., Confluence Data Center, Sourcetree, Jira) to surface only relevant exposures.
    • Supports filtering by attack path — attack vector, privileges required, and user interaction — to isolate unauthenticated, no-interaction reachable CVEs.
    • Supports filtering by patch policy thresholds: CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score cutoffs, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. probability cutoffs, or both combined.
    • Alerts available when new CVEs match configured filters via deployed Intel Agent.

    +2 more show less

    • Vendor advisory support in the Vulnerability Intel Agent now includes Adobe, Android, Apache, Apple, Microsoft, Oracle, and Atlassian.
    • Enrichment columns in the output table are reorderable and individually showable or hidable to match team triage workflows.

    7 details in Everything

18. docs update Aug 6, 2026 · issue 037

    Feedly Vulnerability Intel Agent now ingests Atlassian security releases with per-CVE enrichment, stack filters, and alert deployment

    ⤢ ⤢ ⤢
    • Adds a Latest Atlassian Security Release filter in the Vulnerability Intel Agent that always points to the most recent Atlassian advisory, ingested within minutes of publication — no manual updates needed each cycle.
    • Supports product-level filtering so practitioners can scope CVEs down to the specific Atlassian products (e.g., Confluence Data Center, Sourcetree, Jira) running in their environment.
    • Supports CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. threshold filters to match internal patch policies, letting teams isolate CVEs that breach both thresholds simultaneously.
    • Enables alert deployment on the Intel Agent so teams are notified when newly published CVEs match their configured filters.
    • Extends vendor advisory coverage to Adobe, Android, Apache, Apple, Microsoft, and Oracle — Atlassian is one of several available sources.

    5 details in Everything

19. Threat Intelligence updates — 2026-08-05 Aug 5, 2026 · release notes

    Feedly adds Censys lookup in Insight Cards, SEC filing filters, Ask AI actions, and full KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly./SPL extraction

    • Adds a Censys lookup dropdown to IP indicator Insight Cards.
    • Adds a SEC-filing filter to the Cyber Attack Intel Agent.
    • Adds Ask AI Analyze and Research actions to Custom Intel Agents.
    • Adds the ability to ask about cyber attack target entities in Ask AI.
    • Fixes broken KQL hunting query extraction and adds extraction of full SPL hunting queries.

    5 details in Everything

20. docs update Jul 30, 2026 · issue 030

    Feedly adds Cyberattack Intel Agent with AI-powered filtering, Insights Cards, and real-time Threat Graph monitoring.

    └──▷ HOW TO FIND IT
    When you need to monitor breach disclosures affecting your supply chain, use the Cyberattack Intel Agent's filters to scope to your industry and third-party partners, then drill into an Insights Card for full attack context.
    📍In the Feedly console, open the Cyberattack Intel Agent, apply filters for Industry, Victim, and Attribution, then select an attack to open its Insights Card for aggregated context and use Ask AI to generate a report.
    • New Cyberattack Intel Agent continuously monitors thousands of OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. sources — including SEC filings and regional stock exchanges — to surface relevant attacks in real time.
    • Precision filtering lets analysts narrow large attack sets (e.g., 1,098 attacks → 48 relevant) by attack chain, victim, attribution, and more.
    • Insights Cards provide full attack context — aggregated from thousands of sources via the Real-Time Threat Graph — in a single unified view.
    • Ask AI integration enables streamlined report generation directly from attack data, moving analysts from discovery to actionable intelligence in minutes.
    • Third-party and supply-chain monitoring tracks breach disclosures impacting industry partners across OSINT, security publications, and financial filings.

    5 details in Everything

21. docs update Jul 30, 2026 · issue 030

    Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks via the Threat Graph

22. docs update Jul 30, 2026 · issue 030

    Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks.

23. docs update Jul 30, 2026 · issue 030

    Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks.

24. docs update Jul 30, 2026 · issue 030

    Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks.

25. docs update Jul 30, 2026 · issue 030

    Feedly adds a Cyberattack Intel Agent for discovering and monitoring relevant cyber attacks.

26. docs update Jul 30, 2026 · issue 030

    Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks in real time.

    • New Cyberattack Intel Agent continuously discovers and monitors relevant cyber attacks for your organization.

    1 detail in Everything

27. changelog Jul 27, 2026 · issue 027

    Feedly Ask AI gains SPL query generation and an improved threat actor campaign detection model alongside KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly. support.

    └──▷ HOW TO FIND IT
    Generate a Splunk SPL hunting query for a specific threat actor campaign directly from Ask AI instead of switching to an external query builder.
    📍In the Feedly console, open Ask AI and prompt: "Generate an SPL hunting query for [threat actor] campaigns targeting [industry]."
    • New Ask AI model tuned specifically for threat actor campaign detection.
    • Adds SPL (Splunk Processing Language) hunting query generation to Ask AI, complementing existing KQL support.
    • Improves MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tagging accuracy in Ask AI results.

    3 details in Everything

28. docs update Jul 27, 2026 · docs issue 004

    Feedly Ask AI gains SPL query generation and an improved threat actor campaign detection model alongside KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly. support.

    └──▷ HOW TO FIND IT
    Generate a Splunk SPL hunting query for a specific threat actor campaign directly from Ask AI instead of switching to an external query builder.
    📍In the Feedly console, open Ask AI and prompt: "Generate an SPL hunting query for [threat actor] campaigns targeting [industry]."
    • New Ask AI model tuned specifically for threat actor campaign detection.
    • Adds SPL (Splunk Processing Language) hunting query generation to Ask AI, complementing existing KQL support.
    • Improves MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tagging accuracy in Ask AI results.

    3 details in Everything

29. Threat Intelligence updates — 2026-07-22 Jul 22, 2026 · release notes

    Adds AI-driven threat actor campaign detection and Splunk SPL hunting query support alongside existing KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly..

    • New AI Model for new threat actor campaigns, compatible with Ask AI.
    • New Splunk (SPL) hunting queries AI Model, completing the existing KQL hunting queries.
    • Added an Ask AI panel to Custom Intel Agent Insight Cards.

    3 details in Everything

30. docs update Jul 22, 2026 · issue 022

    Feedly's Vulnerability Intel Agent now ingests Apple security releases in minutes, with CVE filtering by exploitation, product, and patch policy.

    └──▷ HOW TO FIND IT
    Focus your patch cycle on actively exploited CVEs in a new Apple release the day it drops.
    📍In the Vulnerability Intel Agent, select Latest Apple Security Release and set the date range. Add a filter for exploited or 'CISA KEV,' then review the resulting CVE table to prioritize immediate patching.
    Enforce your organization's patch-now SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. by surfacing only CVEs that breach your CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. thresholds.
    📍In the Vulnerability Intel Agent, select the Apple security release, then set a CVSS filter (e.g., ≥ 8) and an EPSS filter (e.g., › 80%) to isolate CVEs requiring immediate remediation under policy.
    Receive automatic alerts when new high-risk CVEs from Apple releases match your filters, without manual checking.
    📍After configuring your filters (exploitation status, product, CVSS/EPSS thresholds) in the Vulnerability Intel Agent, select Deploy to activate the agent and enable notifications for matching new CVEs.
    • Ingests each Apple security release into the Vulnerability Intel Agent within minutes of publication.
    • Supports filtering Apple release CVEs by exploitation activity (exploited, PoC, weaponized, CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal.).
    • Enables product-level filtering to scope CVEs to only the Apple products in your environment.
    • Supports CVSS and EPSS threshold filters to enforce patch-now policies and SLA-driven remediation.
    • Adds an Alerts capability to notify teams when new CVEs in a deployed Intel Agent match configured filters.

    +1 more show less

    • Provides a customizable output table with reorderable, show/hide columns for each CVE enrichment field.

    6 details in Everything

31. docs update Jul 22, 2026 · docs issue 004

    Feedly's Vulnerability Intel Agent now ingests Apple security releases in minutes, with CVE filtering by exploitation, product, and patch policy.

    └──▷ HOW TO FIND IT
    Focus your patch cycle on actively exploited CVEs in a new Apple release the day it drops.
    📍In the Vulnerability Intel Agent, select Latest Apple Security Release and set the date range. Add a filter for exploited or 'CISA KEV,' then review the resulting CVE table to prioritize immediate patching.
    Enforce your organization's patch-now SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. by surfacing only CVEs that breach your CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. thresholds.
    📍In the Vulnerability Intel Agent, select the Apple security release, then set a CVSS filter (e.g., ≥ 8) and an EPSS filter (e.g., › 80%) to isolate CVEs requiring immediate remediation under policy.
    Receive automatic alerts when new high-risk CVEs from Apple releases match your filters, without manual checking.
    📍After configuring your filters (exploitation status, product, CVSS/EPSS thresholds) in the Vulnerability Intel Agent, select Deploy to activate the agent and enable notifications for matching new CVEs.
    • Ingests each Apple security release into the Vulnerability Intel Agent within minutes of publication.
    • Supports filtering Apple release CVEs by exploitation activity (exploited, PoC, weaponized, CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal.).
    • Enables product-level filtering to scope CVEs to only the Apple products in your environment.
    • Supports CVSS and EPSS threshold filters to enforce patch-now policies and SLA-driven remediation.
    • Adds an Alerts capability to notify teams when new CVEs in a deployed Intel Agent match configured filters.

    +1 more show less

    • Provides a customizable output table with reorderable, show/hide columns for each CVE enrichment field.

    6 details in Everything

32. docs update Jul 22, 2026 · issue 022

    Feedly Threat Intelligence adds Apple security release enrichment and triage in the Vulnerability Intel Agent.

    └──▷ HOW TO FIND IT
    Triage Apple security releases (e.g., iOS/macOS advisories) using the Vulnerability Intel Agent to prioritize patching decisions.
    📍In the Feedly console, go to Threat Intelligence › Vulnerability Intel Agent and open an Apple security release to view enrichment and triage details.
33. docs update Jul 22, 2026 · docs issue 004

    Feedly Threat Intelligence adds Apple security release enrichment and triage in the Vulnerability Intel Agent.

    └──▷ HOW TO FIND IT
    Triage Apple security releases (e.g., iOS/macOS advisories) using the Vulnerability Intel Agent to prioritize patching decisions.
    📍In the Feedly console, go to Threat Intelligence › Vulnerability Intel Agent and open an Apple security release to view enrichment and triage details.
34. Enrich and triage Apple security releases in the Vulnerability Intel Agent (2026-07-21) Jul 21, 2026 · issue 022

    Feedly's Vulnerability Intel Agent now ingests Apple security releases within minutes, with enrichment and filtering by exploitation, product, and patch policy.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Focus remediation efforts on only the Apple CVEs in your macOS fleet that are already being exploited or have a published PoC.
    📍In the Vulnerability Intel Agent, select Latest Apple Security Release as the filter and set the date range. Add filters for exploited and proof of concept. Hide iOS and iPadOS rows using the product-level filter to scope results to macOS only.
    Automatically flag Apple CVEs that breach your patch-now SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. thresholds (e.g., CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. ≥ 8 and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. ≥ 80%) so they can be routed to immediate remediation.
    📍In the Vulnerability Intel Agent, select the target Apple security release, then set CVSS threshold filter to ≥ 8 and EPSS threshold filter to ≥ 80%. Deploy the Intel Agent as an alert to get notified when new CVEs matching these thresholds appear in future releases.
    • Adds Apple security release ingestion to the Vulnerability Intel Agent, with each CVE appearing in the output table within minutes of publication.
    • Supports filtering CVEs by exploitation activity (exploited, PoC, weaponized, CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal.) to surface the highest-priority items from a release.
    • Enables product-level filtering so practitioners can scope a release to only the Apple products they actually run (e.g., macOS only).
    • Supports threshold-based patch policy filters on CVSS score and EPSS probability to automatically surface CVEs that breach SLA triggers.
    • Adds a Latest Apple Security Release filter option that always points to the most recent Apple advisory.

    +1 more show less

    • Supports alert deployment on the Intel Agent to notify when new CVEs from a release match configured filters.

    6 details in Everything

35. Faster exploit triage, smarter Org Profiles, and more transparency across your Report Builder Jul 8, 2026 · release notes

    Feedly adds @mention integration for Org Profiles, CVE Insight detail cards, deep citations in Report Builder, and expanded Cyberattack Agent coverage.

    • View exploit type, confidence, reason, and supporting evidence directly on CVE Insights Cards without leaving Feedly.
    • Reference an Org Profile anywhere in Feedly (Ask AI, Report Builder, Newsletter, Custom Intel Agent) using @mention syntax after defining it via direct input or .md upload.
    • Track all references of a given Org Profile across workflows to see where it is being used.

    3 details in Everything

36. Triage indicators faster with VirusTotal verdicts in Feedly (2026-07-07) Jul 7, 2026 · issue 014

    Feedly now embeds VirusTotal verdicts, WHOIS, certs, and reputation scores directly inside IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Insights Cards.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Activate VirusTotal enrichment so detection verdicts appear on every IoC Insights Card your team reviews.
    📍In Feedly, go to Account Settings, locate the VirusTotal integration section, and paste your existing VirusTotal API key to enable enrichment across all IoC Insights Cards.
    • Adds VirusTotal integration: connect your existing VirusTotal API key to surface detection verdicts and reputation scores inside IoC Insights Cards.
    • Embeds WHOIS records, certificate data, network attribution, and community votes on IoC Insights Cards for zero-detection domain analysis.
    • Enables one-click pivot from an IoC Insights Card directly to the full VirusTotal dataset for deeper investigation.
    • VirusTotal enrichment data remains account-scoped — never stored by Feedly and never shared with other users or teammates.

    4 details in Everything

37. Suricata detection rules, Ask AI Research Playground, and more Jun 24, 2026 · release notes

    Suricata rules in Insights Cards, Ask AI Playground, @reference snippets, new State-sponsored actor model

    • Adds access to Suricata detection rules extracted from articles via the Detection Rules section of Insights Cards
    • Introduces the Ask AI Research Playground for self-serve threat intelligence exploration
    • Enables creating reusable text/Markdown snippets in Org Profile and pulling them into prompts using @reference across Ask AI, Report Builder, and Intel Agent
    • Adds a new AI Model: State-sponsored threat actors

    4 details in Everything

38. Track exploit types, Oracle and Atlassian advisories, and more Jun 10, 2026 · release notes

    Feedly adds Atlassian/Oracle filter, PoC model split, Talos/Atlassian/Apache/Google OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. sources, and improved Ask AI.148

    • Adds Proof of Exploit model to distinguish PoC code from active exploitation.
    • Adds Atlassian and Oracle security updates under the Security Update Releases filter in the Vulnerability Agent.
    • Adds 5 new advisory sources: Talos, Symphony, Atlassian, Apache, and Google OSV.
    • Enriches Ask AI responses with intel profile context.

    4 details in Everything

39. Keep your OpenCTI knowledge graph current, automatically (2026-05-28) May 28, 2026 · release notes

    Feedly Threat Intelligence adds an OpenCTI connector that pushes STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. bundles directly from AI Feeds

    └──▷ HOW TO FIND IT
    Deploy the connector and configure it to ingest intelligence for specific threat actors.
    📍1. Deploy connector from OpenCTI repository. 2. Set credentials with Feedly API token and OpenCTI URL. 3. Configure AI Feeds and Folders to scope input. 4. Set ingestion interval (e.g., hourly).
    • Adds a new OpenCTI connector to automatically push STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 bundles from Feedly AI Feeds to the OpenCTI knowledge graphknowledge graphA representation of entities and the relationships between them. Software can follow those connections to answer questions or combine information from different sources.
    • Enables automated extraction of threat actors, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., malware, CVEs, and IoCs from 5,000 open sources into structured STIX entities with mapped relationships

    2 details in Everything

40. Smarter insider threat detection, broader search coverage, and more May 27, 2026 · release notes

    Feedly adds Any Language search filter and rebuilt Insider Threats AI model.

    • Adds Any Language option to Article Search language filter for unrestricted coverage
    • Rebuilds Insider Threats AI Model as semantic topic model with three new core categories
    • Added 4 new vendor advisory sources: Node.js, Ruby, cPanel, OpenVPN Access Server
    • Adds CVE status field to show rejected or reserved CVEs

    4 details in Everything

41. Feedly Best Practices for CTI Teams (2026-05-19) May 19, 2026 · release notes

    Feedly introduces Intel Agents, Ask AI, Report Builder, and MISP integration for CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. teams.

    • Adds Vulnerability Intel Agent for personalized CVE monitoring filtered by vendor, product, and attack vector
    • Adds Cyberattack Intel Agent to monitor real-time attack activity targeting specific industries
    • Adds TTP Intel Agent to track trending ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and launch into MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Navigator
    • Adds Ask AI capability on top of Intel Agents, Insights Cards, and AI Feeds for synthesis and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. extraction
    • Adds Insights Cards providing structured context on CVEs, Cyberattacks, Threat Actors, and IoCs

    +2 more show less

    • Adds Report Builder that extracts sections from templates and auto-populates them with sourced claims
    • Adds support for MISP as an integration destination for enriched feed data

    7 details in Everything

42. Enrich indicators faster with GreyNoise context built into IoC Insight Cards (2026-05-14) May 14, 2026 · release notes

    Feedly Threat Intelligence adds GreyNoise classification signals directly inside IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Insight Cards for in-platform enrichment.

    • Surfaces GreyNoise behavioral and classification signals alongside OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. in IoC Insight Cards

    1 detail in Everything

43. Leverage sharper cyberattack clustering, GreyNoise & VirusTotal enrichment, Apple security updates, and Analyst1 integration May 13, 2026 · release notes

    New Analyst1 integration pulls Feedly data via STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format.; IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. cards get GreyNoise/VirusTotal enrichment; Vulnerability Agent tracks Apple updates.

    • Pulls threat intelligence from Feedly Folders, AI Feeds, or Team Boards into Analyst1 as structured evidence via STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 output.
    • Surfaces contextual threat intelligence from GreyNoise and VirusTotal in IoC Insights Cards via the Integrations page.
    • Includes Apple security updates under the Security Update Releases filter in the Vulnerability Agent.

    3 details in Everything

44. Analyze patterns across 100 cyberattacks with Ask AI in the Cyberattack Intel Agent (2026-05-06) May 6, 2026 · release notes

    Ask AI added to Cyberattack Intel Agent allows custom prompts across up to 100 attacks.

    └──▷ HOW TO FIND IT
    Generate a threat landscape overview for a specific region and industry using custom filters.
    📍In the Cyberattack Intel Agent, filter by time period, industry, and region. Use Ask AI prompt: 'Based on the selected attacks, generate a threat landscape overview for [region] and [industry].'
    Identify novel TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. and IoCs across recent activity using saved Intel Profiles.
    📍In the Cyberattack Intel Agent, select time period and an Intel Profile. Use Ask AI prompt: 'What novel TTPs and IoCs are being leveraged in these attacks?'
    Visualize the attack chain from initial access to impact for selected incidents.
    📍In the Cyberattack Intel Agent, filter by time period, threat actor, and MITRE ATT&CK Tactic. Use Ask AI prompt: 'Visualize the attack chain for these incidents with a diagram mapping each phase from initial access to impact.'
    • Adds Ask AI capability within the Cyberattack Intel Agent allowing analysts to run custom AI prompts against threat data.
    • Enables running custom queries across up to 100 cyberattacks at once in the Cyberattack Intel Agent.

    2 details in Everything

45. Analyze cyberattacks with AI, explore our new TI page, and more Apr 29, 2026 · release notes

    Feedly Threat Intelligence adds Ask AI to Cyberattack Agent and a new TI landing page.

    • Enables CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. analysts to run Ask AI queries directly within the Cyberattack Agent workflow to assess threat actors and map activity.
    • Launches a redesigned Feedly Threat Intelligence landing page at feedly.com/threat-intelligence for overviewing platform capabilities.

    2 details in Everything

46. Navigate faster with Go To, tailor your alerts with custom summaries, and translate newsletters in one click Apr 15, 2026 · release notes

    Add Go To navigation, custom Slack/Teams alert summaries, newsletter translation, and new IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself./CVE search features

    • Adds Go To (Cmd+K) for instant navigation to resources by actor, malware, vulnerability, or IoC
    • Enables custom summaries in Feedly’s integrations for Slack and Microsoft Teams to control focus, format, and detail level of article notifications
    • Adds Translate articles to English button in Newsletter Design for one-click automatic translation
    • Enables searching by victim state in the Cyber Attack agent
    • Adds EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. sections to CVE Insights Card

    5 details in Everything

47. Navigate Feedly Faster with Go To (2026-04-07) Apr 7, 2026 · release notes

    Feedly adds Go To global search via Cmd+K to jump to Insights Cards, Intel Agents, AI Feeds, and Boards

    └──▷ HOW TO FIND IT
    Jump to a specific threat actor's dashboard without clicking through folders.
    📍Hit Cmd + K and type the threat actor name
    Quickly access a saved AI Feed or Board by its exact title.
    📍Click Go To in the left navigation or press Ctrl + K, then search by name
    Retrieve recently viewed threat cards to resume analysis without browser history.
    📍Open Go To and select a page from the automatically shown Recently viewed pages list
    • Adds Go To command launched via Cmd + K (Mac) or Ctrl + K (Windows) to instantly search and navigate to threat intelligence assets.
    • Enables direct navigation to any Insights Card for threat actors, malware families, CVEs, or cyberattacks through the new search interface.

    2 details in Everything

48. Threat Intelligence updates — 2026-04-02 Apr 2, 2026 · release notes

    Feedly Threat Intelligence adds US state filtering to Cyber Attack Agent API, combined V&A queries, and expands coverage with 7 new actors.

    • Adds US state filtering capability to the Cyber Attack Agent API for geographically specific threat intelligence queries
    • Extends EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. classification support to CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. search operations within the Threat Intelligence service
    • Introduces 7 new threat actor profiles to the Feedly Threat Intelligence database
    • Enables Ask AI to process combined Vulnerability and Cyber Attack Agent queries in a single interaction
    • Improves 55 existing TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. detections, including enhanced coverage for T1204.004 (ClickFix) tactics

    5 details in Everything

49. Deliver intel faster via MS Teams, detect never-before-seen techniques, and more Mar 18, 2026 · release notes

    New Microsoft Teams integration with dedup/summarization and Novel TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. AI model for detecting first-seen techniques

    • Microsoft Teams integration now available on the Microsoft Marketplace with built-in deduplication, AI-generated summaries, and automatic translation.
    • New Novel TTPs AI Model in AI Feeds detects articles documenting attack techniques observed for the first time.
    • New AI Model for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. file paths launched to identify file path indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
    • Articles now display a structured IoC list at the top, with new IoC Insights Card accessible from inline mentions.

    4 details in Everything

50. Get threat intelligence to your team fast, in the tools they already use (2026-03-17) Mar 17, 2026 · release notes

    Updated Feedly-Microsoft Teams integration with deduplication, AI summaries, and auto-translation

    └──▷ HOW TO FIND IT
    Verify or enable deduplication to reduce noise from multiple sources covering the same event.
    📍@Feedly manage
    Subscribe a specific threat monitoring feed directly to a Teams channel for automated delivery.
    📍Subscribe Team AI Feed to [Channel Name]
    • @Feedly manage command in MS Teams channels to control integration settings including deduplication toggles.
    • Automatic deduplication of articles from Team AI Feeds sent to Microsoft Teams channels.
    • AI-generated summaries included in notification payloads for rapid relevance assessment.
    • Automatic translation of article titles and summaries into English via Multilingual plan support.

    4 details in Everything

51. Analyze your closed-source intelligence in Feedly (2026-03-10) Mar 10, 2026 · release notes

    Feedly adds PDF upload and Ask AI integration for closed-source threat intelligence analysis

    └──▷ HOW TO FIND IT
    Cross-reference threat actor TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. from a closed-source incident report against real-time open web activity using Ask AI.
    📍Upload incident response report PDF to Feedly, then ask: 'Based on the uploaded report, which TTPs were used by the threat actor, and are these same techniques being reported in the open web right now?'
    Enrich CVEs from a vendor vulnerability report with exploit status and patch availability data from the Threat Graph.
    📍Upload vulnerability report PDF to Feedly, then ask: 'Based on the uploaded report, which CVEs were exploited in this incident, are they currently being actively exploited by other threat actors in the open web, and what does the latest reporting say about patch availability and exploit status?'
    • Enables uploading PDF files directly into Feedly to analyze alongside open-source intelligenceopen-source intelligenceOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feeds via Ask AI
    • Uses the Threat Graph knowledge base to automatically extract and correlate entities like TTPs, CVEs, and IoCs from uploaded documents

    2 details in Everything

52. Simpler ways to query and manage your intelligence Mar 5, 2026 · release notes

    Feedly Threat Intelligence introduces unified query context in Ask AI and full Private Lists management in UI

    • Adds the ability to attach articles, PDFs, Boards, AI Feeds, and vulnerability agents together in a single Ask AI or Research query via a '+' button.
    • Adds UI controls to edit Private Lists directly, including adding/removing companies and products, renaming lists, and viewing entity counts.

    2 details in Everything

53. Full AI capabilities, now on your own PDF reports Feb 18, 2026 · release notes

    Adds PDF upload and AI processing to Feedly with Enable File Upload workspace setting.

    └──▷ HOW TO FIND IT
    Enable PDF ingestion for your team via the workspace configuration.
    📍Workspace Settings › More › Enable File Upload
    • Adds the Enable File Upload toggle under Workspace Settings > More, allowing team admins to allow members to upload PDFs for automatic metadata extraction and Ask AI access.
    • Adds a Files Page to centralize tracking of all team-uploaded documents.

    2 details in Everything

54. Cyberattack Insights Cards: A dynamic 360° attack view (2026-02-18) Feb 18, 2026 · release notes

    Feedly introduces Cyberattack Insights Cards with IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. exportable in STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format., MISP, or CSV.

    └──▷ HOW TO FIND IT
    Export IoCs from a specific attack card to import into your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or threat hunting platform.
    📍1. Open the relevant Cyberattack Insights Card. 2. Locate the 'IoCs exportable in STIX 2.1, MISP, or CSV' option. 3. Select the desired format (STIX 2.1, MISP, or CSV) to download the IoC data.
    • Cyberattack Insights Cards provide a dynamic 360° view of cyberattacks, consolidating threat actors, malware, IoCs, and TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. into a single evolving display.
    • IoCs within Cyberattack Insights Cards can be exported in STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1, MISP, or CSV formats for integration with external security tools.

    2 details in Everything

55. Automate threat briefings and explore cyberattacks faster in Ask AI Feb 5, 2026 · release notes

    Feedly adds Threat Landscape integration for Automated Newsletters and Cyberattack Insights Cards in Ask AI responses.

    • Adds Feedly’s Threat Landscape as a source for Automated Newsletters to pull trending threat intelligence articles automatically

    1 detail in Everything

56. Vulnerability Intel Agent: 7 ways to use CVSS Vector filters for smarter CVE prioritization (2026-02-03) Feb 3, 2026 · release notes

    Feedly's Vulnerability Intel Agent adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. Vector filters for precise CVE prioritization

    └──▷ USE IT
    Find active, wormable threats requiring no user interaction or privileges.
    text copy

    (Privileges Required: None) AND (User Interaction: None) AND (Exploited) OR (Proof of Concept) OR (Weaponized) OR (CISA KEV) AND (Attack Vector: Network) NOT (Patched)

    Identify remote vulnerabilities posing high availability impact.
    text copy

    (Availability Impact: High) AND (Attack Vector: Network)

    • Adds CVSS Vector filters to the Vulnerability Intel Agent interface for filtering CVEs by attack vector, complexity, privileges required, user interaction, impact scope, and exploitation status.
    • Supports Boolean logic (AND/OR/NOT) in CVSS Vector filter configuration to combine multiple vulnerability characteristics.
    • Enables targeting of specific exploitation contexts including Exploited, Proof of Concept, Weaponized, and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. statuses alongside technical attributes like Attack Vector and Confidentiality Impact.

    3 details in Everything

57. Connect indicators to threat actors, malware, and cyberattacks automatically Jan 21, 2026 · release notes

    Feedly Threat Intelligence adds automatic IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.-to-actor attribution, Ask AI IOC cards, and MISP verification.

    • Research IoCs with rich context in seconds, not hours feature automates attribution to threat actors, malware, and cyberattacks via Real-Time Threat Graph.
    • Added IOC Insights Cards to Ask AI responses for instant contextual data.

    2 details in Everything

58. Stop chasing attribution and easily link IoCs to threats Dec 24, 2025 · release notes

    New IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. table in Insights Cards for direct threat attribution

    • Adds an IoCs table within the Insights Card for threat actors, malware families, and cyber attacks
    • Eliminates the need to jump between tabs or hunt through reports to find related IoCs

    2 details in Everything

59. Enrich Vertex Synapse with Feedly Threat Graph intelligence, and extract registry keys IoCs Dec 10, 2025 · release notes

    Enrich Vertex Synapse with Feedly Threat Graph intelligence and extract registry keys IoCs

    • Integrates Feedly integration with Vertex Synapse to automatically ingest indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (IoCs), CVEs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., threat actors, and malware enriched with context from the Feedly Threat Graph.
    • Adds a new AI Model for registry keys IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. types that is STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form.-ready and includes enhanced metadata extracted from source article context.
    • Introduces a new Threat Actors from North Africa AI Model.

    3 details in Everything

60. Enhance CVE assessment, track MITRE ATT&CK v18, and personalize your Intel Profiles Nov 26, 2025 · release notes

    Feedly Threat Intelligence adds CVE vector filtering, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v18 support, and IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. subtype exposure in article JSON.

    • Display and filter by specific CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3.1 vector components for granular vulnerability assessment
    • Track MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. v18 with 12 new Feedly AI Models for enterprise tactics
    • IoC subtypes are now displayed in the article JSON

    3 details in Everything

61. Threat Intelligence updates — 2025-11-12 Nov 12, 2025 · release notes

    Feedly Threat Intelligence adds Custom Lists support in TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard, new Middle East AI model, and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. detection.

    • Adds Threat Intelligence Reports section to the Cyber Attacks insights card
    • Adds New AI Model for 'threat actors from Middle East'
    • Improves IP IoC model to include IPv6 IoC detection

    3 details in Everything

62. Threat Intelligence updates — 2025-10-30 Oct 30, 2025 · release notes

    New Banking Cyberattack Dashboard AI Model; RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. source selection and threat graph toggle in Ask AI.

    • Adds a Banking industry option to the New Cyberattack Dashboard AI Model for monitoring attacks targeting banks
    • Allows adding articles and selecting sources in Ask AI Research mode to enable RAG, with a toggle to enable/disable the threat graph

    2 details in Everything

63. Smarter CVE analysis with Ask AI Oct 15, 2025 · release notes

    Feedly adds Ask AI integration to Vulnerability Dashboard with personalized prompts and expands CSV export limits

    • Integrates Ask AI directly into the Vulnerability Dashboard to allow personalized prompt input for prioritizing and summarizing CVE intelligence with inline citations.
    • Expands the CSV export limit in the Vulnerability Dashboard to return up to 10,000 results.
    • Adds support for sha256 as an IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Hash subtype field in the article JSON output.

    3 details in Everything

64. Access the Feedly app in the Slack marketplace Oct 1, 2025 · release notes

    Release adds Slack Marketplace integration and improves IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search normalization, dashboard loading, and AI mapping.

    • Improved keyword search for specific IoCs using normalization rules for indexing
    • Improved loading time of the Vulnerability Dashboard when a product version filter is present

    2 details in Everything

65. Unlock Multilingual AI in your Feeds Sep 17, 2025 · release notes

    Unlock Multilingual AI in your Feeds adds language filtering to new AI Feeds for Threat Intelligence.

    • Enables discovery of articles in any language within AI Feeds by allowing users to set preferred languages when building the feed

    1 detail in Everything

66. Collect intel on any threat, then export IoCs in seconds Sep 3, 2025 · release notes

    Export IoCs and TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. from Team Boards in CSV, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format., or MISP

    • Enables export of TTPs to ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Navigator directly from selected articles or the entire board (max 200 articles)
    • Improves STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. export format for IP with port as separate network traffic objects
    • Adds description field to threat TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. STIX objects in exports

    3 details in Everything

67. New dashboard columns for faster cyber attack analysis Aug 20, 2025 · release notes

    Feedly adds Status, What/So What columns and Recently Reported filter to Cyber Attacks Dashboard.

    • Adds Status column to the Cyber Attacks Dashboard to distinguish between newly reported attacks and those with recent timeline updates within a time filter
    • Adds What, So What column to the Cyber Attacks Dashboard providing structured two-bullet insights on threat type, target scope, affected data, and impact
    • Adds Latest Activity column to the Cyber Attacks Dashboard to surface the most recent timeline event directly in the table

    3 details in Everything

68. Granular analytics, AI-powered Threat Actor Insights, and key improvements Aug 7, 2025 · release notes

    Feedly Threat Intelligence adds granular newsletter analytics with interactive graphs and CSV export, Ask AI in Threat Actor Insight Cards, and new Nuclei/Advisory filters.

    • Adds an interactive graph to compare key metrics like recipients, open rate, and click rate for newsletters
    • Adds CSV export capability to download and share analytics reports
    • Adds time range analysis to track performance over custom periods
    • Adds a reader and article engagement table to see who is reading what
    • Adds Ask AI functionality in Threat Actor Insight Cards to run specific queries on threat actors

    +1 more show less

    • Makes the Nuclei Vulnerability Scanner filter available in the Vulnerability Dashboard

    6 details in Everything

69. Investigate smarter, collaborate better, and onboard faster with these new features Jul 23, 2025 · release notes

    Adds Cyber Attack Insights Cards to AI Feeds, Ask AI for Malware Insights, team onboarding page, and role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..

    • Unlocks Cyber Attack Insights Cards in AI Feeds providing attack summary, timeline, and links to threat actors, malware, IoCs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and CVEs
    • Enables Ask AI within Malware Insights Cards to generate summaries, reports, and answer targeted questions about specific malware
    • Introduces a dynamic Getting Started page for automatic team onboarding in enterprise accounts
    • Adds role-based access management with Admin, Editor, and Viewer roles to control workspace permissions

    4 details in Everything

70. Introducing two major upgrades: Cyber Attack Dashboard & AI Search Jul 9, 2025 · release notes

    Feedly introduces Cyber Attack Dashboard for filtering and tracking attacks, plus AI Search with cited threat intelligence answers.

    • New Cyber Attack Dashboard provides real-time updates on evolving attacks with filterable views by industry, country, threat actor, malware family, or attack type
    • New Cyber Attack Insights Cards drill down into individual attacks with timelines, IoCs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., CVE links, and article references
    • New Search - AI Mode allows asking natural language questions for structured, cited answers from curated sources and threat graph data

    3 details in Everything

71. Break language barriers in your research with Feedly AI’s 15 supported languages Jun 25, 2025 · release notes

    Feedly AI adds Multilingual support for Arabic, Polish, Ukrainian, and Vietnamese in All Feeds & Web tabs.

    • Adds Multilingual AI support for Arabic, Polish, Ukrainian, and Vietnamese, enabling global threat intel without language barriers
    • Enables Feedly AI to deduplicate stories and automatically translate articles to English across the 15 supported languages

    2 details in Everything

72. New CVE context, smarter filters, and multilingual insights Jun 11, 2025 · release notes

    EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. ID display in CVE cards, product version filtering in dashboard, and JP/KR/RU language support.

    • Enables filtering vulnerabilities by specific product versions in the Vulnerability Dashboard
    • Supports discovering insights written in Japanese, Korean, and Russian via English queries

    2 details in Everything

73. Ask AI just got better with prompt suggestions May 28, 2025 · release notes

    Ask AI prompt suggestions and threat actor tags in MISP integration added to Feedly Threat Intelligence

    • Adds prompt suggestions (expert-curated and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-generated) in Ask AI when selecting multiple articles for Feedly Threat Intelligence Advanced 2024 plans.
    • Adds threat actor tags support in the MISP integration for Feedly Threat Intelligence Advanced plan.

    2 details in Everything

74. Enrich your TIP with this new integration! May 14, 2025 · release notes

    Adds ThreatConnect integration and LinkedIn feed support to Feedly Threat Intelligence

    • Adds ThreatConnect integration to deliver contextual intelligence directly into your TIP.
    • Enables following LinkedIn feeds in Feedly Threat Intelligence.

    2 details in Everything

75. Get contextual prompt and variable suggestions in Ask AI May 1, 2025 · release notes

    Feedly Ask AI adds contextual prompt and variable suggestions based on article content.

    • Ask AI now scans the current article to instantly suggest expert (curated by TI/MI analysts) and dynamic (LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-generated) prompts
    • Ask AI suggests relevant variables for refinement fields in expert prompts based on article metadata and subject, supporting aliases for threat actors or companies

    2 details in Everything

76. Smarter CVE analysis, multilingual research, and LinkedIn monitoring Apr 16, 2025 · release notes

    Feedly Threat Intelligence adds Ask AI integration to CVE cards, LinkedIn URL feeds, and Dutch/Portuguese multilingual search.

    • Adds Ask AI direct integration on CVE Insight Cards with specialized expert prompts and automatic article selection for CVs analysis
    • Enables follow of LinkedIn profiles by pasting profile URLs into the Website search box to create RSS feeds via the RSS Builder
    • Adds Dutch and Portuguese languages to Multilingual AI capabilities with cross-language deduplication and automatic English translation

    3 details in Everything

77. Custom charts, Power Search upgrades, and more Apr 2, 2025 · release notes

    Feedly adds customizable Vulnerability Dashboard charts with PNG export and enhanced Power Search filters.

    • Adds PNG export for individual charts in the Vulnerability Dashboard to help users include them in reporting
    • Adds ability to choose between pie or horizontal bar chart for each section of the Vulnerability Dashboard, saved as default
    • Enhances Power Search with time range filtering across the web, single-tab source selection (All Web, Feeds, Boards, annotated articles), language selection, and source type filters such as press releases or tech blogs
    • Adds top-quality sources filter option to Power Search
    • Enables tracking of malware types in the TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard

    5 details in Everything

78. New: Sidebar, Ask AI, and AI in Automated Newsletters Mar 5, 2025 · release notes

    Feedly Threat Intelligence adds Ask AI for report synthesis, AI in Automated Newsletters, and a revised sidebar.

    • Adds Ask AI capability to synthesize up to 25 threat reports and articles in multiple languages, extracting IoCs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and actionable insights
    • Integrates AI generation into Automated Newsletters to help deliver clear, actionable threat intelligence content
    • Replaces the previous dock with a revised, more flexible sidebar for personalized experience

    3 details in Everything

79. Threat Intelligence updates — 2025-02-19 Feb 19, 2025 · release notes

    TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. dashboard now supports malware type selection; Malware and Threat Actor Insight Cards gain new data fields.

    • Adds the ability to select any malware type in the TTP dashboard
    • Adds affected platforms to Malware Insight Cards
    • Adds threat actor motivation to Threat Actor Insight Cards

    3 details in Everything

80. Smarter insights, faster decisions - Security update releases, Chinese multilingual AI, Auto-translations Feb 5, 2025 · release notes

    Security Update Releases filter added to Vulnerability Dashboard; Chinese multilingual AI and auto-translation enabled in All Web tab.

    • Adds Security Update Releases filter to the Vulnerability Dashboard for Microsoft Patch Tuesday CVEs
    • Adds Chinese language coverage to AI Models for story search in the All Web tab
    • Enables auto-translation of articles from Chinese, French, German, Italian, and Spanish to English

    3 details in Everything

81. New in Feedly: Multilingual AI, PDF Insights, and Smarter CVE Timelines Jan 22, 2025 · release notes

    Feedly Threat Intelligence adds multilingual AI deduplication/translation, PDF insight extraction, and CVE timeline sorting.

    • Adds multilingual search across dozens of languages with automatic deduplication and English translation in the All Web tab
    • Enables processing of publicly accessible PDFs to extract metadata, visual content, and ask AI-driven questions
    • Defaults CVE timelines to newest-first sorting with a toggle for oldest-first

    3 details in Everything

82. Threat Intelligence updates — 2025-01-08 Jan 8, 2025 · release notes

    Feedly Threat Intelligence adds Top sources only filter and per-email invalid address validation in Automated Newsletters.

    • Adds individual invalid email flagging and specific feedback for each address during bulk recipient addition in Automated Newsletters

    1 detail in Everything

83. Threat Intelligence updates — 2024-11-20 Nov 20, 2024 · release notes

    Deprecated v3/vulns/.mget endpoint and increased vulnerability dashboard search result volume.

    • Increased the number of search results displayed in vulnerability dashboard product selectors.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The v3/vulns/.mget API endpoint is deprecated and will be removed in the future; callers must migrate to v3/entities/.mget.
84. Threat Intelligence updates — 2024-11-06 Nov 6, 2024 · release notes

    TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard gets Threats Targeting Country filter; CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. autocomplete improves

85. Threat Intelligence updates — 2024-10-23 Oct 23, 2024 · release notes

    Feedly adds font/text customization to Automated Newsletters, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. country exports, and Vice Spider AI card.

    • Automated Newsletters now support text customization including font styles, sizing, color-coding, alignment, highlighting, headers, quotes, and bullet points.

    1 detail in Everything

86. Extract IoCs from external links and sign up to Feedly Threat Intelligence on mobile Sep 11, 2024 · release notes

    Mobile account creation for Feedly Threat Intelligence and configurable CVE Insight cards.

    • Enables users to create a Feedly Threat Intelligence account directly from the mobile app interface
    • Allows changing the CVE version displayed on CVE Insights Cards when applicable

    2 details in Everything

87. New PDF export on Automated Newsletters Aug 28, 2024 · release notes

    Feedly adds PDF export for newsletters and new AI models for malware detection.

    • Adds Export PDF capability to Automated Newsletters via UI controls

    1 detail in Everything

88. Automated Newsletters update & new AI Model Aug 14, 2024 · release notes

    Feedly Threat Intelligence adds AI Feed integration to newsletters, Strategic Initiative detection model, and UI enhancements.

    • Adds AI Feeds integration to the newsletter template editor for direct incorporation into Automated Newsletters
    • Introduces a new Strategic Initiative AI Model to track organizational initiatives, programs, acceleration programs, and donation initiatives
    • Increases precision of malware disambiguation for ambiguous names such as Sugar or LSD
    • Adds a tooltip to CVE links in AI Actions responses to provide additional context
    • Shows a product preview during onboarding for new users starting the Feedly Threat Intelligence trial

    +2 more show less

    • Adds an EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. and a Product column to the Exploited Vulnerabilities table in Threat Actor and Malware Insights Cards
    • Adds an Open in Navigator button to the header of Threat Actor and Malware Insights Cards

    7 details in Everything

89. Two-factor authentication available on your accounts Jul 31, 2024 · release notes

    Feedly Threat adds 2FA via TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. and exports TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. to ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Navigator

    • Adds two-factor authentication using a TOTP authenticator for Feedly login types, accessible from the Logins page in settings
    • Enables exporting TTPs to ATT&CK Navigator directly from Threat Actor and Malware Insights Cards

    2 details in Everything

90. Double opt-in processes for Automated Newsletter emails & Anomali ThreatStream integration Jul 17, 2024 · release notes

    Adds Anomali ThreatStream integration for automated threat intel ingestion and double opt-in for EU newsletter compliance.

    • Adds Anomali ThreatStream integration to ingest Feedly AI-discovered IoCs, threat actors, malware, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and CVE relationships.
    • Adds double opt-in process for automated newsletter emails to support GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. compliance in the European Union.

    2 details in Everything

91. Threat Intelligence updates — 2024-07-03 Jul 3, 2024 · release notes

    Feedly Threat Intelligence enhances onboarding, retracts AI models from suggestions, and deepens CVE detection links

    • Revamped threat intelligence onboarding displays personalized content and recommendations to new users from the start.
    • CVE Timeline's Attribution of Exploits event now links directly to the corresponding threat actor or malware Insights Card.

    2 details in Everything

92. Threat Intelligence updates — 2024-06-19 Jun 19, 2024 · release notes

    New newsletter scheduling frequencies (weekly, biweekly, monthly), MISP integration tag management, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. dashboard filter, and CVE Insights vendor extraction.

    • Adds weekly, biweekly, and monthly frequency options to the Newsletter Schedule for Feedly Newsletters
    • Allows setting the distribution type in the updated MISP Integration
    • Enables creation of local or global custom MISP tags via the MISP Integration update
    • Displays the Feedly user who added an article to the Team Board as a static MISP tag
    • Adds a Last 24 hours filter to the TTP Dashboard

    5 details in Everything

93. Introducing Feedly AI Actions for Threat Intelligence Jun 5, 2024 · release notes

    Feedly adds AI Actions for threat intelligence analysis and enhances MISP feed support with user tags and distribution settings.

    • AI Actions feature to analyze threat campaigns, extract patterns, and create customized reports grounded in selected articles
    • Support for adding local user tags and controlling distribution in MISP feeds

    2 details in Everything

94. New changelog featuring Mitre ATT&CK v15.1 May 22, 2024 · release notes

    Feedly adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15.1 coverage via Feedly AI and updates MISP polling frequency

    • Adds discovery of 12 new MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. v15 techniques through Feedly AI
    • Updates OpenCTI integration to use intrusion sets field instead of threat actor groups
    • Increases MISP integration polling frequency to every 10 minutes for Team Folders and every 30 seconds for Team Boards
    • Improves content extraction by removing sanitization step to preserve IoCs in articles

    4 details in Everything

95. Introducing Top Stories and new sharing options to Bluesky and Threads May 8, 2024 · release notes

    Adds Top Stories tab with AI filtering and sharing to Bluesky/Threads.

    • Adds a Top Stories tab that highlights articles supported by over 5 references for Enterprise and Pro+ users.
    • Adds direct article sharing capabilities to Bluesky and Threads for Enterprise and Pro+ users.
    • Adds a MISP Feed tag signaling which user(s) added an entry to a board.
    • Updates the Export as STIX 2.1 option availability to include Tactics and Techniques article prompts.
    • Adds date filter, Article Count graph, and updated Exploited Vulnerabilities table to Threat Actor Insights Cards.

    5 details in Everything

96. New changelog featuring our new Microsoft Sentinel Integration Apr 24, 2024 · release notes

    Feedly adds Microsoft Sentinel integration for importing IoCs from Team Folders.

    • Adds a new data connector in the Azure marketplace that imports IoCs extracted from Feedly Team Folders and Boards directly to Microsoft Sentinel
    • CVE Insights Cards now have improved summaries
    • Vulnerability AI Models now appear in autocompletes when CVE or CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. is queried

    3 details in Everything

97. New changelog featuring suggested Models in autocomplete Apr 10, 2024 · release notes

    New Mastodon feed support for IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. detection and enhanced model autocomplete.

    • Added support for Mastodon feeds for IoC detection
    • The AI feed autocomplete is now more generously suggesting AI Models based on user input

    2 details in Everything

98. Power Search custom date range & deduplication in Automated Newsletters Mar 27, 2024 · release notes

    Feedly adds Power Search date range selectors, newsletter deduplication, 0day.today feed, and CVE card PDF export.

    • Adds a custom date range selector to Power Search for historical queries across Team Feeds and Boards
    • Automatically deduplicates articles appearing in multiple Folders within the same Automated Newsletter
    • Makes the source 0day.today available as a new feed option (also included in the Vulnerability Starter Kit)
    • Adds PDF export and favorite options to the CVE Insights Card

    4 details in Everything

99. Threat Intelligence updates — 2024-03-13 Mar 13, 2024 · release notes

    New landing pages for Threat Intelligence and clickable threat actor names on Insights Cards

    • Adds dedicated product landing pages for Threat Intelligence, Market Intelligence, and News Reader with free trial and sales demo links.
    • Enables clicking threat actor and malware names directly on Insights Cards to open their respective detail views.

    2 details in Everything

100. Introducing Malware Insights Cards, Political Instability AI Model Feb 14, 2024 · release notes

     Feedly adds Malware Insights Cards, Political Instability AI Model, OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., AlmaLinux/VMware feeds, and CVE card EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. data

     • Adds Malware Insights Cards to the Threat Landscape Dashboard, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard, article AI prompts, and threat actor AI model tooltips for malware family research
     • Adds a new Political Instability AI Model to detect open-source articles indicating frequent government changes or political faction lack of consensus
     • Adds OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect SSO support for Feedly Threat and Market Intelligence customers
     • Adds feeds for AlmaLinux and VMware security advisories, included in the Security Advisories Starter Kit
     • Updates CVE Insights Cards to include the EPSS value in the copy to clipboard button output

     5 details in Everything

101. Threat Intelligence updates — 2024-01-31 Jan 31, 2024 · release notes

     Feedly Threat Intelligence adds industry and platform filters to the TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard plus new threat actor detections.

     • Adds filtering by industry in the TTP Dashboard
     • Adds filtering by platform (e.g., macOS) in the TTP Dashboard
     • Adds New Threat Actors filter to the TTP Dashboard
     • Adds Threat Actors from filter (e.g. Threat Actors from China) to the TTP Dashboard
     • Makes six new threat actors discoverable: TAG-28, Flax Typhoon, Cyber Partisans, Caliente Bandits, Cotton Sandstorm, and Blackwood

     5 details in Everything

102. Threat Intelligence updates — 2024-01-17 Jan 17, 2024 · release notes

     Feedly Threat Intelligence adds CVE timeline highlights, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. platform filtering, and an interactive API developer site.

     • /api/threat-intelligence integration docs and testing via the new API Developer site for Threat and Market Intelligence customers
     • CVE timeline Highlights button to highlight specific events across all timelines
     • TTP Dashboard platform filter capability
     • New New Threat Actors model for threat actor analysis
     • New country-based Threat Actors from <Country> models for threat actor analysis

     5 details in Everything

103. EclecticIQ integration Jan 3, 2024 · release notes

     EclecticIQ integration adds no-code STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. ingestion for threat data.

     • Adds the EclecticIQ integration for automatic ingestion of Feedly threats into EclecticIQ Intelligence Center as STIX objects
     • Adds ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. description tooltips and links to Mitre ATT&CK in TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. visualizations
     • Enables PDF export for the Threat Actor Insights Card
     • Adds article and targeted companies counts to bar charts in Threat Actor Insights Cards
     • Unlocks access to articles labeled Others in the Threat Actor Insights Card

     +1 more show less

     • Displays an ex marker in Vulnerabilities section metadata to indicate exploit availability

     6 details in Everything

104. Threat Intelligence updates — 2023-12-13 Dec 13, 2023 · release notes

     CVE Timelines added to CVE Insights Card; detection rule export and enhanced CVE AI Prompt available

     • Adds CVE Timelines to the CVE Insights Card to track critical vulnerability events from discovery to exploitation.

     1 detail in Everything

105. Introducing AI Actions, Threat Actor Insight Cards Nov 15, 2023 · release notes

     Feedly Threat Intelligence adds AI Actions (summarization, translation, custom prompts), Threat Actor Insight Cards, Cortex XSOAR integration, and dark mode auto-detection.

     • Beta: AI Actions for articles, offering Summarization, Translation into supported languages, and a Custom Action for running customized prompts on article content
     • Threat Actor Insight Cards display trending TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., exploited vulnerabilities, targeted countries/industries, malware links, and threat intelligence reports, accessible from the Threat Landscape Dashboard, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard, or article AI Prompt tooltips
     • XSOAR Integration allows importing articles from Feedly folders/boards (including IoCs and threat actor/malware/TTP relationships) into Cortex XSOAR without writing code
     • UI improvement: Appearance settings now include an option to automatically set the theme (light or dark mode) based on device settings

     4 details in Everything