Intel Exchange Spoke is a threat intelligence processing and collaboration platform built specifically for ISAC and ISAO member organizations. It helps security operations centers (SOCs) take the curated, enriched intelligence they receive from their ISAC/ISAO hubs and actually put it to work in day-to-day defense.

Spoke is designed to:

• Operationalize threat intelligence so teams can move from just reading intel reports to automatically ingesting, analyzing, and acting on them.
• Enhance existing processes without requiring more staff or highly specialized threat intel expertise.
• Strengthen collaboration in a trusted sharing environment, making it easier to share relevant, structured intel back to ISACs and ISAOs.

In practice, this means member organizations can get more value from their ISAC/ISAO memberships, even if they are just starting their threat intelligence journey or don’t have enterprise-level security maturity yet.

Intel Exchange Spoke is built to help ISAC/ISAO members ramp up threat intelligence operations without heavy overhead or long deployment cycles.

Key ways it helps you get started quickly:

• Fast deployment: The platform is designed to kickstart threat intelligence ingestion with deployment in within 24 hours, so you see value quickly.
• No advanced expertise required: Teams don’t need deep, enterprise-level threat intel skills or high security maturity to begin leveraging intel effectively.
• Cost-effective approach: Spoke focuses on using automation and integrations to reduce budget impact and eliminate the need for additional analyst resources.
• Built-in automation: You can automatically ingest technical threat intelligence (like IOCs) from your ISAC/ISAO and start using predefined rules or SOAR playbooks to take action.

Overall, Spoke is meant to help you reimagine your first steps in threat intelligence—from manual, ad-hoc work to structured, automated workflows that your existing team can manage.

Intel Exchange Spoke is designed to fit into your current security ecosystem while strengthening two-way collaboration with your ISAC/ISAO.

Tool integrations:

• Integrates with commonly used security tools such as SIEM and SOAR platforms.
• Supports automated actions in tools like firewalls, IPS, NBAD, UEBA, and others using out-of-the-box rules or SOAR workflows.
• Enables automated ingestion, scoring, and actioning of technical threat intelligence (including IOCs).

Collaboration and sharing:

• Lets ISAC/ISAO sharing groups create a trusted sharing network for automated, bidirectional IOC sharing.
• For ISACs/ISAOs using Intel Exchange (CTIX), Spoke allows members to easily ingest and act on curated intelligence streams without adding new resources.
• Supports sharing intel back to ISACs/ISAOs in STIX 2.1 format, encouraging more structured, member-driven intelligence contributions.
• Helps extend intelligence availability through both the ISAC/ISAO feeds and the Cyware feed.

By combining integrations with your existing stack and standardized sharing (like STIX 2.1), Spoke helps you reshape how you collaborate on threat intelligence across your sharing community.