Threat intelligence subscriptions

Name: Threat intelligence subscriptions
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects threat-intelligence subscription records - licence and account details, feed API keys, TAXII endpoints and collection IDs for commercial or community CTI feeds. Subscription wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated subscription field (subscription/licence/account ID, API key, client ID, collection ID, renewal date) or a TAXII/feed API endpoint URL or collection UUID), and 85 needs two distinct structures plus independent subscription-context (fees, renewal, STIX/TLP, ISAC, quotas) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 5
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:threat\s+intel(?:ligence)?\s+(?:subscriptions?|feeds?|platform|service|licen[cs]es?|portal)|TAXII\s+(?:collection|server|feed|endpoint)|MISP\s+(?:instance|feed|community|sync)|CTI\s+(?:feed|subscription|platform))\b

Corroborative evidence keywords

annual fee, renewal, poll interval, STIX, TLP, sharing agreement, ISAC, vendor contact, licensed users, feed quota

Proximity: 300 characters

Should match

Procurement approved renewal of the threat intelligence subscription for another year. — Discovery probe (65) - subscription wording only
Threat intelligence feed onboarding Subscription ID: HTX-448210 API key: 9b1f7c22e4a84d0f — Medium-tier probe (75) - populated subscription fields
TAXII collection access - Harbour Health SOC Account ID: HH-SOC-0194 API key: 9b1f7c22e4a84d0f Endpoint: https://intel.tidewatercti.net/taxii2/collections/5f8c2d1e-7a44-4b0e-9c31-2e7f1a6d9b40/objects/ Poll interval 15 minutes; renewal due 30/06/2027, annual fee AUD 48,000. — High-tier probe (85) - account fields, TAXII endpoint URL with collection UUID, renewal and fee context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: threat intelligence feeds must be sourced from vetted providers and reviewed annually. — Policy text without subscription details
Threat intelligence subscription template Subscription ID: ________ API key: [insert] — Blank template
Webinar recap: how a threat intelligence platform uses STIX and TAXII collections to share indicators. — Training/webinar framing

Known false positives

Vendor marketing and CTI explainers describe feeds, TAXII and MISP. Mitigation: Topic wording is discovery-only; enforcement needs populated subscription fields or endpoints and guidance/news framing is excluded.