How to Create and Manage Feeds

In DigitalStakeout XTI, feeds are persistent searches or data collectors that continuously aggregate and process new data matching specified criteria. These feeds form the core of proactive threat detection, brand monitoring, and digital footprint surveillance workflows.

Feeds are highly configurable and can ingest data across public web, social media, dark web, commercial feeds, and more.

🔁 How Monitors Work

Always-On Collection: Monitors continuously scan for data based on your filters, keywords, and selectors.
Automated Enrichment: As data flows in, XTI automatically normalizes and enriches it for faster triage.
Unified Intelligence Feed: All matched events are aggregated into the XTI console with linked metadata and search filters.

🔍 What Happens in the Background

Process	Description
Normalization	Standardizes incoming data for consistency
Entity Extraction	Annotates 50+ data fields (e.g., people, organizations, locations, etc.)
Tagging	Adds user-defined or system-generated tags based on content
Smart Discovery	Surfaces signals and patterns that match alert thresholds or behavioral logic
Real-Time Alerting	Sends notifications for important or sensitive matches

🛠️ Key Monitor Types

You can create monitors based on specific data streams. Examples include:

Keyword Feed — Monitor keyword mentions in dark web, blogs, or social platforms
Domain Feed — Track new domain registrations or DNS signals tied to your brand
CVE Feed — Watch for chatter related to actively exploited vulnerabilities
Email Collector — Forward emails into XTI for indexing and tagging
Presence Feed — Track online activity of known social media accounts

Each monitor type has its own field settings, filters, and enrichment logic. See individual documentation pages for setup steps.

🧭 Setting Up a Monitor (General Workflow)

Go to Setup → Feeds
Click Add Feed
Select a soruce type (e.g., Keyword, Domain, Homepage, CVE)
Define search inputs (keywords, selectors, exclusions, etc.)
Set tags, use case, translation preferences, and expiration (if needed)
Save and activate the feed

Feeds will begin aggregating immediately if set to Enabled.

✅ Best Practices

Be specific: Start with narrow criteria to avoid overwhelming noise
Use tags: Group monitors by topic, region, or threat type for easy filtering
Review weekly: Check event hits, refine keywords, or adjust alert thresholds
Integrate downstream: Route output to reporting, analyst dashboards, or external systems
Tune continuously: Monitors work best when aligned with evolving risks, campaigns, or assets