Home / Roadmap & Labs / Month 3 / Lab 11 – Threat Intelligence Integration

Lab 11 – Threat Intelligence Integration

Integrate external threat‑intelligence feeds into your SIEM and IDS/IPS to enrich alerts with context and improve detection accuracy.

Theme: Threat Intelligence Estimated time: 3–4 hours

Objective Lab goal

This lab enhances your detection capabilities by integrating open‑source threat‑intelligence feeds into your SIEM and IDS/IPS. You’ll configure OTX, AbuseIPDB, and blocklists, then validate enriched alerts.

  • Outcome 1: OTX and AbuseIPDB feeds integrated into SIEM.
  • Outcome 2: IDS/IPS rules enriched with threat‑intel indicators.
  • Outcome 3: Alerts correlated with external threat data.
  • Outcome 4: Threat‑intel workflow documented.
Lab 11: Threat Intelligence Integration
Lab 11: Integrating OTX, AbuseIPDB, and blocklists into SIEM and IDS/IPS.

Deliverables End‑of‑lab checklist

  • DL11.1: OTX API key configured in SIEM.
  • DL11.2: AbuseIPDB lookups enabled.
  • DL11.3: IDS/IPS rules enriched with threat‑intel indicators.
  • DL11.4: Enriched alerts validated.
  • DL11.5: Documentation updated with feed sources and workflow.

Lab Steps Step‑by‑step instructions

Step 1 – Configure OTX Threat Feed

~30 minutes
  1. Create an OTX account and generate an API key.
  2. In your SIEM, navigate to Threat Intelligence → Integrations.
  3. Add your OTX API key and enable pulse synchronization.
  4. Verify indicators appear in the threat‑intel dashboard.

Step 2 – Enable AbuseIPDB Lookups

~30 minutes
  1. Create an AbuseIPDB account and generate an API key.
  2. Enable IP reputation lookups in SIEM and IDS/IPS.
  3. Set thresholds for automatic tagging of malicious IPs.
  4. Test lookup using a known malicious IP.

Step 3 – Integrate Blocklists & Custom Feeds

~45 minutes
  1. Add community blocklists (FireHOL, Spamhaus DROP, etc.).
  2. Configure automatic updates for blocklists.
  3. Import custom indicators (IPs, domains, hashes) into SIEM.
  4. Verify indicators propagate to IDS/IPS rules.

Step 4 – Validate Enriched Alerts

~45 minutes
  1. Trigger a controlled scan or DNS query to a known malicious domain.
  2. Verify SIEM alert includes:
    • Threat‑intel source
    • Reputation score
    • Indicator category
  3. Confirm IDS/IPS generates a correlated alert.
  4. Document enriched alert workflow.

Reflection What you should understand now

  • Context: How threat‑intel enriches raw alerts with external data.
  • Correlation: How SIEM and IDS/IPS combine intel for stronger detections.
  • Automation: How feeds keep your defenses current.

With threat‑intelligence integrated, your homelab now benefits from global visibility into malicious activity. In Week 12, you’ll simulate network attacks and validate IDS/IPS and SIEM correlation accuracy.

◀️ Previous: Lab 10 – Packet Capture & Traffic Analysis  |  Next: Lab 12 – Network Attack Simulation & Detection Validation ▶️