How to Create and Manage XTI (Feeds)
Learn how to create feeds in DigitalStakeout XTI to continuously discover, process, and act on new threat, brand, and content intelligence from the web.
How to Create and Manage Feeds
In DigitalStakeout XTI, feeds are persistent searches or data collectors that continuously aggregate and process new data matching specified criteria. These feeds form the core of proactive threat detection, brand monitoring, and digital footprint surveillance workflows.
Feeds are highly configurable and can ingest data across public web, social media, dark web, commercial feeds, and more.
🔁 How Monitors Work
- Always-On Collection: Monitors continuously scan for data based on your filters, keywords, and selectors.
- Automated Enrichment: As data flows in, XTI automatically normalizes and enriches it for faster triage.
- Unified Intelligence Feed: All matched events are aggregated into the XTI console with linked metadata and search filters.
🔍 What Happens in the Background
| Process | Description |
|---|---|
| Normalization | Standardizes incoming data for consistency |
| Entity Extraction | Annotates 50+ data fields (e.g., people, organizations, locations, etc.) |
| Tagging | Adds user-defined or system-generated tags based on content |
| Smart Discovery | Surfaces signals and patterns that match alert thresholds or behavioral logic |
| Real-Time Alerting | Sends notifications for important or sensitive matches |
🛠️ Key Monitor Types
You can create monitors based on specific data streams. Examples include:
- Keyword Feed — Monitor keyword mentions in dark web, blogs, or social platforms
- Domain Feed — Track new domain registrations or DNS signals tied to your brand
- CVE Feed — Watch for chatter related to actively exploited vulnerabilities
- Email Collector — Forward emails into XTI for indexing and tagging
- Presence Feed — Track online activity of known social media accounts
Each monitor type has its own field settings, filters, and enrichment logic. See individual documentation pages for setup steps.
🧭 Setting Up a Monitor (General Workflow)
- Go to Setup → Feeds
- Click Add Feed
- Select a soruce type (e.g., Keyword, Domain, Homepage, CVE)
- Define search inputs (keywords, selectors, exclusions, etc.)
- Set tags, use case, translation preferences, and expiration (if needed)
- Save and activate the feed
Feeds will begin aggregating immediately if set to Enabled.
✅ Best Practices
- Be specific: Start with narrow criteria to avoid overwhelming noise
- Use tags: Group monitors by topic, region, or threat type for easy filtering
- Review weekly: Check event hits, refine keywords, or adjust alert thresholds
- Integrate downstream: Route output to reporting, analyst dashboards, or external systems
- Tune continuously: Monitors work best when aligned with evolving risks, campaigns, or assets
Want to see all monitor types and coverage areas?
Visit the DigitalStakeout XTI Coverage Overview on our main site.
Updated 2 days ago