threadlinqs
RSS · JSON Feed · free

Free Threat Intelligence RSS Feed with Detection Rules

Each item carries a free detection in Sigma, Splunk SPL and KQL where one exists, plus sample IOCs.

New threats from Threadlinqs Intelligence, written for a reader and a SIEM: the summary, the severity, the MITRE ATT&CK techniques, a detection you can paste into your stack, and the sources behind it.

Free, no account needed to subscribe
Follow on Feedly RSS feed JSON Feed

The feed URL is https://intel.threadlinqs.com/feed.xml. Paste it into any reader.

Sigma rules in the feed

Most threat intelligence feeds stop at a headline and a link. Each item in this feed is a small, complete briefing: the analysis, then the detection that goes with it, in the three languages a detection engineer actually deploys.

01

Summary and severity

A readable summary in real paragraphs, cut at a sentence boundary with a link to the full analysis, and the severity: Critical, High, Medium or Low.

02

MITRE ATT&CK

The ATT&CK techniques observed in the threat, listed by ID so you can map the item to your coverage.

03

One detection, three languages

The threat's free detection: its title, then the rule in Sigma, Splunk SPL and Microsoft KQL, each in its own code block. A body that fails our shape check is left out, not shown broken.

04

The other detections, by name

The remaining detections for the threat are listed by title, marked unlock with TL Creds. Their rule bodies are not in the feed.

05

Sample IOCs

Three indicators per threat, defanged and marked TLP:CLEAR, with a count of how many the threat has in total. The full indicator set unlocks with TL Creds.

06

Sources

Up to five outbound links to the original reporting the item is built from, so you can check it yourself.

Feed URLs

One canonical address for the main feed. It lists the newest 50 threats; add ?limit= for more or fewer (the value snaps to 20, 50 or 100).

https://intel.threadlinqs.com/feed.xml https://intel.threadlinqs.com/feed.json

RSS 2.0 at /feed.xml, JSON Feed 1.1 at /feed.json. Both carry the same items. The older spellings /rss.xml, /atom.xml, /feed and /rss redirect to /feed.xml.

Filtered by severity

SeverityRSSJSON Feed
Critical/feed/severity/critical.xml.json
High/feed/severity/high.xml.json
Medium/feed/severity/medium.xml.json
Low/feed/severity/low.xml.json

Filtered by category

CategoryRSSJSON Feed
Vulnerability/feed/category/vulnerability.xml.json
Malware/feed/category/malware.xml.json
Supply Chain/feed/category/supply-chain.xml.json
Phishing/feed/category/phishing.xml.json
Ransomware/feed/category/ransomware.xml.json
APT/feed/category/apt.xml.json
Threat Intelligence/feed/category/threat-intel.xml.json
Data Breach/feed/category/data-breach.xml.json
Zero-Day/feed/category/zero-day.xml.json
ICS/SCADA/feed/category/ics-scada.xml.json
Cloud Security/feed/category/cloud.xml.json

Feeds are served from a short edge cache, so a new threat can take up to about 15 minutes to appear in the main feed and up to 30 minutes in the severity and category feeds.

Set it up in your reader or platform

Feedly

  1. Select Follow on Feedly. Feedly opens with the feed ready to add.
  2. Choose the board or folder it should live in, then select Follow.
  3. To follow only one slice, repeat with a filtered URL from the tables above, for example the Critical severity feed.

Inoreader

  1. Choose Add new and enter the feed URL https://intel.threadlinqs.com/feed.xml.
  2. Confirm the subscription and pick a folder.
  3. Optionally add a filter or rule on severity or an ATT&CK technique ID to route items to a folder.

OpenCTI

  1. Open Data, then Ingestion, then RSS feeds, and create a new feed.
  2. Paste https://intel.threadlinqs.com/feed.xml as the URL and choose the report types the items should create.
  3. Start the feed. New threats arrive as reports, with the summary, the detection blocks and the defanged sample indicators in the content.

Any other reader or SIEM that accepts RSS 2.0 or JSON Feed works the same way: add the URL, set a polling interval of 15 minutes or more, and filter on the severity or category feeds if you only want part of the stream.

Licence, TLP and corrections

  • Indicator samples are TLP:CLEAR. The three sample indicators per item are defanged. The full indicator set for a threat unlocks with TL Creds.
  • Free detection, TL Creds for the rest. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest.
  • Corrections. If an item is wrong or out of date, tell us. How to report one, and how corrections are marked, is on the editorial standards page.

© 2026 Threadlinqs. Indicator samples are TLP:CLEAR.

More from Threadlinqs Intelligence

Browse the full corpus of threats, CVEs and actors at intel.threadlinqs.com, read the daily debrief, or connect an assistant through the MCP server.