The Cybersecurity and Infrastructure Security Agency runs Automated Indicator Sharing (AIS) as a STIX 2.1 / TAXII 2.1 threat-indicator feed for critical-infrastructure operators. The Commercial Facilities Sector ISAO carries event-relevant advisories — venue threats, sports-facility indicators, public-assembly TTPs — that paid CTI vendors typically don't isolate from their general feeds.
SignalGuard ships a TAXII 2.1 client that polls AIS at configurable intervals and normalizes STIX 2.1 objects into the brief's threat-intel layer. The result: free, sector-tagged CTI alongside whatever paid intel you already run.
What it tells you
- What threat indicators are CISA + sector ISAOs tracking for entertainment venues right now? Active IPs, domains, file hashes, and TTPs scoped to the Commercial Facilities Sector.
- Which indicators match my recent activity? When SignalGuard sees an indicator overlap with chatter or operational telemetry, the brief surfaces it.
- What advisories are sector-relevant this week? CISA emergency directives and joint advisories filtered for the Commercial Facilities Sector tag.
- How does this compare to what my paid intel vendor is saying? Cross-reference between AIS indicators and your enriched feeds (Recorded Future, Mandiant, Flashpoint) to triangulate confidence.
Pricing reality
Free. CISA AIS is a federal program with no fee and no contract.
| Step | What's required | Cost |
|---|---|---|
| Enrollment | Sign PII agreement at cisa.gov/ais | Free |
| Authentication | TAXII 2.1 token issued by CISA | Free |
| Polling | Configurable interval, no rate cap for normal use | Free |
| SignalGuard ingestion | STIX 2.1 normalization into threat-intel layer | Included in plan |
Best for
- MSSPs running venue SOCs — sector-tagged CTI to layer onto per-venue dashboards.
- Parent-org security teams — portfolio-wide indicator screening with a federal source-of-truth citation.
- Stadium ops with mature CTI programs — adding the AIS feed alongside existing paid CTI for cross-source confirmation and cost-effective coverage.
How SignalGuard wires it
Native integration. SignalGuard ships a TAXII 2.1 client that polls CISA AIS at configurable intervals; STIX 2.1 indicators are normalized into the brief's threat-intel layer. Setup:
- Enroll at cisa.gov/ais. Sign the PII agreement (no payment, no contract).
- CISA issues a TAXII token. Drop it into your SignalGuard workspace as
CISA_AIS_TOKEN. The token is AES-256-GCM encrypted at rest. - Configure poll interval (default: 15 minutes) and sector filter (default: Commercial Facilities). SignalGuard handles paging, dedup, and STIX-object normalization.
Indicators flow into the threat-intel layer of every scan in scope. No per-scan setup; the client runs continuously in the background.
Run a scan
Run a scan with CISA AIS wired in → or review pricing tiers to see how threat-intel signals fit into your plan.