TIL: You can use Reference Data Sets as a poor-man's threat intel feed. Simple walkthrough.

So we're mid-migration from an old on-prem QRadar to a new SaaS tenant, and our usual threat intel feed ingestion broke during the cutover. Classic migration war story, right? While the network team was sorting out the new connectors, we needed *something* running to avoid a complete blind spot.

Turns out, Reference Data Sets are way more flexible than I gave them credit for. We ended up using them as a temporary, manual threat intel feed. It's not perfect for high-volume, but for a curated list of IOCs or emergency blocks, it works in a pinch.

Here's the quick walkthrough we used:

* **Created a new Ref Data Set:** Named it `Manual_ThreatIntel_Cutover`. Keyed it on something simple like `indicator` (for IPs or domains).
* **Populated it via CSV:** We had a short list of known-bad IPs from our old system. Exported to CSV with columns `indicator` and `threat_type`. Used the **Bulk Load** function in the UI.
* **Referenced it in a rule:** Built a simple rule test during the migration window.
* Rule logic: `when the offense is created` -> `if source IP is in reference set 'Manual_ThreatIntel_Cutover'` -> `then set offense severity to HIGH`.
* **Manual updates:** You can add single entries via the UI or re-load a CSV. We had a junior analyst updating it hourly from a shared spreadsheet until the proper feed came back online.

The obvious pitfalls:
* It's manual. No automatic TLP:RED expiry.
* Doesn't scale for thousands of indicators.
* You miss out on all the metadata a real TI feed provides (confidence, actor, etc.).

But for a migration gap or a super quick, internal "block these now" list? Absolute lifesaver. Made me wonder what other "temporary" migration hacks people have used with Ref Data Sets. Anyone else been down this road?