Their "Emerging Threat" feed is a firehose of garbage. My team is drowning in alerts for IPs that are just CDN nodes or benign cloud services. Classic "look, a squirrel!" detection.
I've tried tuning the confidence scores and tags, but the noise floor is still too high. Anyone else filtering this feed successfully? What's your pipeline look like? I'm about to write a custom filter in Go that cross-references ASN and known service tags before it even hits the SIEM.
My current half-baked filter for the feed ingestion looks like this, but it's not enough:
```yaml
# anomaly-filter.yaml
filters:
- rule: "exclude_high_confidence_cdn"
condition: "confidence > 85 && tags contains 'cdn'"
action: drop
- rule: "exclude_common_cloud"
condition: "ip in $(curl -s https://api.cloudprovider.com/v1/ips )"
action: drop
```
What am I missing? Are we just using the wrong feed?