Intel Exchange Spoke is a threat intelligence processing and collaboration platform built specifically for ISAC and ISAO members. It helps security operations centers (SOCs) turn curated intelligence from their ISAC/ISAO hubs into practical, day-to-day security actions.

Many member organizations don’t have dedicated threat intelligence teams or advanced security maturity. Spoke is designed to enhance existing processes without adding new headcount or heavy overhead. It allows teams to:

• Ingest curated and enriched threat intelligence from their ISAC/ISAO
• Analyze and act on indicators of compromise (IOCs)
• Share relevant intelligence back to their ISAC/ISAO in STIX 2.1 format

By doing this, Intel Exchange Spoke helps members operationalize threat intelligence, improve response times, and get more value from their existing ISAC/ISAO memberships—without needing enterprise-level expertise or a large analyst team.

Intel Exchange Spoke is designed to help ISAC/ISAO members move from simply receiving intel to using it in daily security operations, even if you’re just getting started.

Key ways it helps you operationalize threat intelligence:

• Fast deployment: You can kickstart threat intelligence ingestion with deployment in as little as 24 hours, so value is realized quickly.
• Automated ingestion: Automatically ingest technical threat intelligence from your ISAC/ISAO and other sources (e.g., STIX 2.1 feeds, threat mailbox, URL scraping, manual intel creation).
• Normalization and analysis: Spoke handles de-duplication, correlation, and analysis of malware data, IOCs, threat actors, vulnerabilities, and other SDOs.
• Dedicated TI module: A focused threat intelligence module lets you receive, view, and manage IOCs in one place.
• Automated actioning: You can take automated action on scored technical intelligence directly in tools like SIEM, firewall, IPS, NBAD, and UEBA using out-of-the-box rules or SOAR.

This combination helps you move from manual, ad hoc intel handling to a more structured, automated approach—without needing advanced in-house TI expertise.

Intel Exchange Spoke is built to reimagine how ISACs, ISAOs, and members collaborate on threat intelligence, while keeping costs and staffing needs in check.

Collaboration and sharing benefits:

• Trusted sharing networks: Enable sharing groups to create a trusted network for automated, bidirectional IOC sharing between members and their ISAC/ISAO.
• Standardized format: Share pertinent data back to ISACs and ISAOs in STIX 2.1 format, encouraging more consistent and higher-volume member-based intel sharing.
• Extended intelligence availability: ISACs and ISAOs can extend their intelligence through both their own feeds and the Cyware feed, giving members broader coverage.

Cost and resource advantages:

• Cost-effective for members: Intel Exchange Spoke is positioned as a cost-effective way for ISAC/ISAO members to gain initial threat intelligence capabilities beyond open-source tools.
• No additional analysts required: The platform is designed to reduce budget concerns and eliminate the need for additional analyst resources by automating ingestion, scoring, and actioning.
• Tool integrations: Integrates with commonly used security tools such as SIEM and SOAR, so organizations can leverage existing investments rather than buying and staffing new platforms.

For ISACs and ISAOs already using Intel Exchange (CTIX), Spoke lets their members easily ingest and act on curated intelligence, strengthening the overall sharing community and improving collective defense without a proportional increase in cost or staffing.