My results after disabling all third-party threat feeds - surprise, not much changed.

Hey folks, I wanted to share a recent experiment I ran in our Anomali ThreatStream instance that really surprised me. As some of you know, I’ve been neck-deep in security data migrations for years, moving from old SIEMs to platforms like this, and I’ve always operated under the assumption that more data equals better detection. So, we were ingesting a bunch of third-party threat feeds—some commercial, some open-source—thinking they were our frontline defense.

Last month, during a performance tuning session for our PostgreSQL backend that holds the threat intel, I noticed something: the vast majority of our genuine alerts were coming from our internal telemetry (firewall logs, EDR, proxy) and from very specific, vetted feeds tied to our industry. The long tail of generic IP/Domain feeds was creating a ton of noise in the database, bloating the observable tables, and making correlation jobs slower, but weren’t actually surfacing unique, actionable incidents for *us*.

So, I took a deep breath and disabled all third-party feeds for a 30-day trial. I kept only:
* Our internal log sources.
* The industry-specific malware hash list from our ISAC.
* One domain feed focused strictly on brand impersonation (because we’re a big phishing target).

The setup in ThreatStream looked like this for the main feed I turned off:

```json
{
"feed": "Generic_Malware_IP_List",
"enabled": false,
"reason": "Experimental tuning - efficacy review Q3",
"retention_days": 7
}
```

And you know what? The sky did not fall. Our alert volume dropped by about 65%, which was expected. But critically, the number of **prioritized, true-positive incidents** that the SOC had to investigate remained almost identical. We were just saving them from sifting through hundreds of low-fidelity alerts. The platform performance improved noticeably too—fewer database locks during ingestion peaks and faster dashboard loads.

The big lesson for me, especially coming from a data engineering mindset, is that **context and quality drastically outweigh volume**. We’re now using the saved license costs from those feeds to invest in better tuning of our internal source connectors and building more refined watchlists. It feels like we cleaned out a very cluttered, generic data lake and built a smaller, purpose-built reservoir.

Has anyone else done a similar “feed diet”? I’m curious if your experience matches mine, or if you found a particular external feed that’s genuinely indispensable. Let’s compare notes! 😊

—B