Instead of Feedly Threat Intelligence
Reconsider your Feedly Threat Intelligence bill. Own your intelligence desk.
We build your analyst working system around your questions and review rules, map your authorised Feedly exports across and run your version for you. Agree the intelligence collection you need alongside the records you want to own.
Feedly quotes Standard and Advanced privately. Bring your current quote so we can separate collection services from the working records your team can own.
- check_circleYour data in a database you own
- check_circleOpen source, no lock-in
- check_circleBuilt and run by Enterprise DNA
Read the bill against the work
A collection service and an analyst desk are different parts of the job
Feedly packages source discovery, intelligence research and team delivery. Its pricing page asks for a quote. This alternative starts with the records after collection: what you reviewed, why it mattered and who must act.
Finding the intelligence
Feedly collects and filters source material. Decide which collection service your team needs while keeping your own review decisions outside that service.
Source context
Feedly exports can include original article context. Keep that context beside your imported indicators so an analyst can inspect the evidence again.
Whole-team access
Feedly lists whole-team access on Standard. In your own working system, access is designed around your organisation and its source restrictions.
Connections to other systems
Advanced lists integrations and a threat graph connection. Choose the connections your version needs when Enterprise DNA scopes the managed service.
Briefing preparation
Feedly lists newsletter templates and a report builder. Your own desk prepares local assessment dossiers from source evidence and the decisions your analysts record.
Ongoing service
Feedly includes an intelligence adviser in its plans. Enterprise DNA builds and runs your working system through Omni by Enterprise DNA, with the collection and review responsibilities agreed explicitly.
The working system you own
Evidence, decisions and follow-through in one place
Morning triage
Know what needs a fresh look
Open the review queue and see the report, owner and due date together.
- check Reports without a completed review stay visible
- check Overdue sources sit beside their accountable analyst
- check Unknown sharing labels appear in the record checks
- check Your own review dates decide what comes back tomorrow
Indicator review
Keep a reason behind every accepted indicator
An address or domain is a lead to assess. Keep the decision and its evidence attached.
- check Review confidence and rationale are explicit
- check Acceptance needs linked sources with known sharing labels
- check Expired accepted indicators return to the review queue
- check Repeat imports preserve your existing decisions and expiry dates
Intelligence questions
Show which business questions still lack evidence
Connect source reports to the questions your desk has agreed to answer.
- check Each question has an owner and priority
- check Relevance decisions name the analyst and rationale
- check Questions without relevant evidence stay on the gap list
- check Compare your own question coverage with overdue actions in one weekly review
Assessment papers
Draft the briefing from the original records
Source-labelled dossiers join indicators, assessments, actions and notes.
- check Source links stay attached to the assessment
- check Additional sharing restrictions remain visible
- check Action closure needs recorded completion evidence
- check Your business name and colours appear on the generated paperwork
Make it yours
Design your own Feedly Threat Intelligence replacement
Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from Feedly Threat Intelligence. Try it here, and we build the real one.
2. What it runs
3. Make it fit
4. Your colour
Answered from your own database
Good morning. Here is what needs you today.
We build it from the open-source base, bring your Feedly Threat Intelligence data across and run it for you.
What it looks like
Ask it like you would ask a colleague
Real answers from the demo data that ships with Threat Intelligence for Claude Code. It runs in Claude Code inside the Claude app, so it feels like any chat you already use.
Threat Intelligence for Claude Code
Connected to your own database
Which source reports need a fresh review?
R-101
- Title
- Fictional supplier phishing exercise
- Owner
- Mara
- Tlp
- TLP:AMBER
- Review_due
- 2026-11-09
- Overdue_days
- 2
- Unreviewed
- 1
R-103
- Title
- Fictional partner report
- Review_due
- 2026-11-10
- Overdue_days
- 1
- Unreviewed
- 0
| Ref | Title | Owner | Tlp | Review_due | Overdue_days | Unreviewed |
|---|---|---|---|---|---|---|
| R-101 | Fictional supplier phishing exercise | Mara | TLP:AMBER | 2026-11-09 | 2 | 1 |
| R-103 | Fictional partner report | 2026-11-10 | 1 | 0 |
Ask it anything
Ten questions your own desk answers
These answers use the imported evidence and decisions you record. The examples below come from the fictional demo.
Switching
How to switch from Feedly Threat Intelligence
A move usually involves exporting the working records your account allows, mapping them into the new database, checking the import, then running both systems briefly before you retire Feedly.
- 1
Export your working records
Feedly documents an article indicator export as CSV. Export the indicator records you use, and export sources, intelligence questions, assessments and actions if your account allows it. The available export path for those other records is not specified here, so check with Feedly and use the formats your account provides, usually CSV or Excel. Keep source sharing labels and restrictions with the records.
- 2
Load and test the records
Use the documented import for authorised article indicator CSVs, and run its test before applying the import. The test checks values without adding them to the database. Other working records need their own agreed mapping and loading approach, since the documented import is for article indicators. If Enterprise DNA runs your version, it handles the mapping and checks the result against your source records.
- 3
Review flagged records
Check the import results for values that need attention, then compare the loaded indicators with your Feedly export. Confirm that each indicator links to the right source and that headings have been mapped correctly. Review source sharing labels and restrictions, and make sure imported indicators remain leads for analyst review. Confirm the records against your own decisions before relying on them in the new desk.
- 4
Run both side by side
Keep Feedly available while you use the new desk for a short period. Compare the working records and review process, including indicators, assessments and follow-up actions, so you can spot gaps before retiring the old working set. Keep Feedly's intelligence collection and enrichment available until you have agreed how those separate needs will be handled, since the new records base does not reproduce them.
- 5
Switch off Feedly when ready
Retire Feedly only after you have checked the records you need, resolved import issues and confirmed the new desk fits your review process. Make a clear decision about intelligence collection and enrichment first. Those Feedly capabilities sit outside the free records base, so switching off Feedly may require a separate replacement for them. Keep your exported records and a backup according to your organisation's handling rules.
Where the real effort goes
The main work is usually mapping your own fields and rules, then deciding how much history to bring across. The documented import covers article indicator CSVs, while other working records need their own mapping. You also need to check source labels, restrictions and record links. If Enterprise DNA installs and runs your version, it handles the mapping and checks the result against your source records.
Not ready for a call?
Get your Feedly Threat Intelligence switch plan by email
We will send you the step-by-step plan for moving your business off Feedly Threat Intelligence, what the move really involves, and how we would do it for you.
Sent. Check your inbox.
Your Feedly Threat Intelligence switch plan is on its way.
Rather talk it through? Book a call arrow_forwardThree ways to own it
Do it yourself, have it customised, or have it run for you
Open source
Do it yourself
Free, open source
- 1 Clone the repo, install dependencies and run npm run demo
- 2 Open the folder in Claude Code, Codex, OpenCode or Cursor
- 3 Export an article's Feedly indicators and inspect the CSV headers and source restrictions
- 4 Run the import with your source details, then review the indicator and evidence counts
Built around your business
We customise it
One setup fee, then a retainer for ongoing work
- check Your intelligence questions, fields and review rules
- check Your authorised Feedly exports mapped across and reconciled
- check A team screen or a different technical foundation if you need it
- check Approved source connections and access rules designed around your organisation
Omni by Enterprise DNA
We run it for you
One setup fee, then a retainer
- check Installed with access and backups set up
- check Review queues and assessment papers prepared from your records
- check Source connections maintained within the scope you agree
- check Operated through Omni by Enterprise DNA alongside your business systems
Questions
Instead of Feedly Threat Intelligence, answered
Does this replace everything in Feedly Threat Intelligence? expand_more
The free version replaces the analyst working records after export: sources, indicators, questions, assessments and actions. Feedly also collects and enriches intelligence. Enterprise DNA scopes the collection and connections your version needs before you retire another service.
Can we bring our existing indicators across? expand_more
Yes. Feedly documents article indicator exports as CSV. The free import checks the values, links them to the source you supply and preserves existing analyst decisions on repeat imports. Different export headings need mapping. Enterprise DNA handles that mapping and checks the result against your source records.
Will it block a domain or declare an attack for us? expand_more
It records your analyst's decision and its evidence. An imported indicator is a lead for review. Enterprise DNA can build the approved hand-off to your security tools as part of your version, with the authorisation and review steps agreed first.
How are restricted source reports handled? expand_more
Source sharing labels and additional restrictions stay on the records and assessment dossiers. Brief drafts are held when a source label is unknown, restricted to named recipients or has extra restrictions. Your analyst still checks permission before sharing. Enterprise DNA sets up the access separation your organisation needs.
What do we pay Enterprise DNA? expand_more
One setup fee, then a retainer. The scope covers your records, review process, agreed connections and ongoing operation. Bring your Feedly quote and a sample export to the call so the work is based on what your team actually needs.
Bring your quote and one real review queue
Spend 30 minutes with Sam on the intelligence you collect, the decisions you keep and the work that is overdue. We will map the working system your team can own and the services it still needs.
Threat Intelligence for Claude Code is free and open source, published by Enterprise DNA.
Done paying for Feedly Threat Intelligence?
Get your version built