When you purchase intelligence feeds, you are generally purchasing flow emanating from the fire hose.

In order to be successful in matching the external environment to your internal situation, you must first be able to parse out or extract the atomic indication (with its relationship data) from the feed.

This means, If you are getting the feed as an email, you have to be able to identify the elements of the email that can be relevant to you. Without the ability to parse this out, you will seldom find a match. You can’t rely on your intel guy to read the entire fire hose flow, make sense of it, and make good warnings and recommendations.

If you are getting the feed as a JSON stream or an XML document or via API, you need to make sure that the atomic items important to you are readily accessible. If they are not, you will seldom find a match.

Finally, If you are only looking for IOCs (ignoring IOT, IOI, and IOO), you are only worrying about what has already happened in the past. This is important, but not the value you really want to get from your intelligence analyst.