CrowdStrike Adds Tool to Pull Your Own Threat Intelligence Into One Security Platform

CrowdStrike has announced a new feature for its Falcon Next-Gen SIEM platform called Third-Party IOC Management. It is designed to help security teams use threat intelligence from many different sources alongside the company's own adversary intelligence and security data. The vendor describes this as a "Bring your own intelligence" approach.

The problem it targets is a common one. Every organisation faces a different threat profile, shaped by its industry, location, infrastructure and operations. Teams draw intelligence from commercial providers, information sharing groups (ISACs), government sources, open-source research, trusted partners and their own threat hunting and incident response work. According to CrowdStrike, valuable indicators often sit in spreadsheets, ticketing tools and threat intelligence platforms, disconnected from the security data analysts rely on.

CrowdStrike says that manually moving and maintaining these indicators creates extra work. Limited real-time matching and outdated indicators of compromise (IOCs, the digital clues that point to known malicious activity) can delay detection, trigger unnecessary alerts and slow investigations. The new feature centralises the ingestion, curation and lifecycle management of third-party indicators inside the platform. The source describes four key capabilities, but the excerpt provided does not list them, so this article does not cover them.