figma guide
Designing threat intelligence feeds and IOC management UI in Figma: feeds, blocklists, and handoff
Design threat intelligence feed and IOC management UI in Figma with feed connectors, indicator tables, blocklist sync, expiry rules, and Dev Mode specs for enterprise Security admin.
- Published
- Updated
- Jul 24, 2026
- Read time
- 8 min
- Level
- Intermediate
Quick answer
Threat intelligence UI helps security teams ingest, review, and enforce indicators (IPs, domains, file hashes) from trusted feeds—without blocking legitimate traffic by accident. Design a feed catalog with source, format, freshness, and sync status; IOC table with type, severity, confidence, expiry, and enforcement action; review queue for new indicators before auto-block; blocklist sync to firewalls, IP allowlist, and automation workflows; and false-positive reporting tied to audit log. Start from the Figma guides hub and pair with SIEM ingestion, alerting, DLP, and Dev Mode handoff.
Who this is for
- Product designers building Threat Intel platforms, feed connectors, and IOC enforcement panels for enterprise Security admin consoles.
- Design system teams aligning indicator chips with badges, tables, and severity color tokens from color systems.
- Engineers implementing STIX/TAXII parsers, deduplication, TTL expiry, and idempotent blocklist pushes to edge devices.
Feed catalog (admin hub)
FeedCatalog
├── Header: Threat intelligence · [ Add feed ] [ Sync all ] [ IOC search ]
├── Summary: 8 feeds active · 14,204 IOCs · 312 pending review · Last sync 6m ago
├── Filters: Feed source · IOC type · Confidence · Enforcement status
└── Row: CrowdStrike Intel · STIX 2.1 · 2,841 IOCs · Synced · 12 pending review| Column | Content |
|---|---|
| Feed name | ”AlienVault OTX”, “MISP community”, “Internal honeypot” |
| Format | STIX 2.1, TAXII 2.1, CSV, JSON, custom webhook |
| IOC types | IP, domain, URL, file hash (MD5/SHA256), email |
| Freshness | Last successful sync, next scheduled pull |
| Confidence policy | Auto-enforce High+ only; Medium → review queue |
| Status | Connected / Auth error / Paused / Deprecated |
| Owner | Threat intel team or SOC lead |
Verdict: catalog separates community feeds (always review) from vendor-signed feeds (auto-enforce with confidence threshold).
Link feed health to SIEM connectors—shared OAuth and webhook patterns reduce admin confusion.
IOC table and detail drawer
IOCTable
├── Search: 185.220.* · Filter: IP · Confidence ≥ Medium · Active only
├── Bulk: [ Approve ] [ Extend TTL ] [ Whitelist ] [ Export STIX ]
└── Row: 185.220.101.42 · IP · High · Block outbound · Expires 7d · Source: FS-ISAC| Field | UI detail |
|---|---|
| Indicator value | Monospace; copy button; link to investigation workspace |
| Type chip | IP / Domain / URL / Hash / Email |
| Confidence | Low / Medium / High / Critical with color token |
| Severity | Mapped from feed or overridden by analyst |
| Enforcement | Monitor only / Alert / Block / Quarantine file |
| TTL / expiry | Countdown badge; auto-archive when expired |
| First seen / Last seen | From feed metadata or internal sightings |
| Related alerts | Count link to alerting |
| False positive flag | Analyst override with reason |
Detail drawer: STIX raw snippet (redacted), feed lineage, enrichment (geo, ASN, WHOIS), linked automation workflows that reference this IOC.
Use tables with sticky bulk-action bar; expandable rows for STIX context.
Review queue (human gate)
ReviewQueue
├── Pending: 312 new IOCs from 3 feeds · Sort: Confidence desc
├── Row: evil-cdn.example · Domain · Medium · Proposed: Block DNS
├── Context: 0 internal sightings · 2 other feeds agree · Similar to allowlisted CDN
├── Actions: [ Approve block ] [ Monitor only ] [ Reject ] [ Whitelist pattern ]
└── SLA: Auto-expire unreviewed Low confidence after 72h| Pattern | UI detail |
|---|---|
| Confidence gate | High+ auto-enforce; Medium/Low land in queue |
| Multi-feed agreement | Badge when 2+ feeds report same indicator |
| Conflict warning | Indicator overlaps IP allowlist or partner domain |
| Bulk approve | Filter by feed + type; require second analyst for Critical |
| Reject reason | False positive, stale, duplicate, out of scope |
| Audit | Every decision writes audit event |
Pair with team roles—Threat Analyst vs Threat Admin for approve vs configure feeds.
Blocklist sync and enforcement
EnforcementTargets
├── Cloud WAF — Synced 4m ago · 12,044 rules · 3 push errors
├── Identity proxy — Synced 12m ago · Domain blocklist
├── Email gateway — Manual export · CSV last downloaded yesterday
└── [Automation hook](/designing-security-automation-and-response-workflows-ui-in-figma/) — Trigger on new Critical IP| Target | Sync behavior |
|---|---|
| Edge / WAF | Push IP/domain lists; show diff since last sync |
| DNS filter | Domain + wildcard patterns with TTL |
| Endpoint EDR | Hash block via API; large batches queued |
| SIEM | Enrichment lookup table—not block, but tag events |
| Custom webhook | POST new Critical IOCs to automation trigger |
Show sync diff preview before push: “+42 new, -18 expired, 2 conflicts with allowlist.”
Rollback: one-click revert to previous blocklist snapshot—critical after bad feed day.
Whitelist, overlap, and false positives
OverlapWarning
├── IOC: 203.0.113.0/24 · Block proposed
├── Conflicts: IP allowlist "Partner VPN egress" · 3 active admin sessions
├── Recommendation: Monitor only until allowlist exception filed
└── [ Open allowlist ] [ Create exception ticket ]| Pattern | Purpose |
|---|---|
| Global whitelist | Corporate domains, CDN ranges, scanner IPs |
| Temporary exception | Time-boxed allow with expiry and owner |
| False positive report | Member or analyst flags block; feeds into feed tuning |
| Suppression link | Tie to alerting suppression for related rules |
| Feedback to feed | Export FP list to vendor (no PII) |
Surface FP rate per feed on posture dashboard—high FP feeds get paused automatically.
Feed configuration wizard
AddFeedWizard
├── Step 1: Source — TAXII collection URL or upload STIX bundle
├── Step 2: Auth — API key · OAuth · mTLS cert · Link [API keys](/designing-api-keys-and-personal-access-tokens-ui-in-figma/)
├── Step 3: Mapping — IOC type fields · Confidence scale normalization
├── Step 4: Policy — Auto-enforce threshold · Review queue rules · Default TTL
├── Step 5: Targets — WAF · DNS · SIEM enrichment · Webhook
└── Test pull: Preview 50 IOCs without enforcing| Step | Handoff note |
|---|---|
| Auth | Store credentials in vault reference—not plain text |
| Mapping | Document STIX path → internal schema in Dev Mode |
| Policy | Default TTL prevents stale blocks (e.g., 30d IP, 90d domain) |
| Test pull | Required before “Enable enforcement” toggle unlocks |
Use progress stepper for wizard; modals for destructive “Disable feed and remove IOCs.”
Prebuilt feed templates
| Template | Format | Default policy | Pairs with |
|---|---|---|---|
| Commercial TI (STIX/TAXII) | TAXII 2.1 | High+ auto-block | SIEM enrichment |
| ISAC community feed | STIX bundle | All → review queue | Vendor risk |
| Internal honeypot export | JSON webhook | Critical auto-block | Automation lock workflow |
| Phishing domain list | CSV daily | Domain block + alerting | Email gateway |
| Known-bad file hashes | STIX | EDR quarantine | DLP |
| Tor exit nodes | Public list | Monitor only | IP allowlist tune |
Template gallery uses cards with enforcement badge and estimated IOC volume.
Posture and feed hygiene
Feed into security posture dashboard:
PostureGapCard — Threat intel hygiene
├── 1 feed auth token expires in 3 days
├── 8% of active IOCs past recommended TTL
├── Feed "Community X" false positive rate 22% (threshold 10%)
└── [ Review queue ] [ Rotate feed credentials ]Metrics: IOCs added/removed per day, blocks triggered, FP reports, mean time in review queue.
Pair with incident runbooks—“Mass false block from feed” playbook linked from feed error banner.
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Auto-block all feed IOCs | Blocks partner VPN or CDN | Confidence gate + review queue |
| No TTL on indicators | Stale blocks years later | Default expiry per IOC type |
| Allowlist not checked at sync | Production outage | Overlap warning before push |
| Plain-text feed API keys | Leak in admin export | Vault reference |
| No sync diff preview | Accidental mass unblock | Show +/- diff with confirm |
| Missing audit on approve | Cannot prove SOC2 control | Audit every enforce decision |
| Hash-only block without context | Wrong file variant blocked | Show hash algorithm + file name pattern |
| Community feed auto-enforced | Low-quality intel blocks users | Never auto-enforce unvetted community feeds |
| No rollback snapshot | Bad push takes hours to fix | Versioned blocklist snapshots |
| IOC search without normalization | Misses punycode/domain variants | Normalize in search UX |
Recommended workflow
- Design feed catalog with format, freshness, confidence policy, and sync status.
- Build IOC table with type chips, confidence, enforcement, TTL, and detail drawer.
- Add review queue with multi-feed agreement, overlap warnings, and bulk actions.
- Wire enforcement targets with sync diff, error retry, and rollback snapshot.
- Create feed wizard with test pull, vault auth, and mapping documentation.
- Surface whitelist overlap and false-positive reporting with feed-level metrics.
- Link posture gaps and annotate STIX mapping in Dev Mode.
FAQ
STIX/TAXII vs custom CSV feeds?
STIX/TAXII preserves confidence, relationships, and expiry—prefer for commercial feeds. CSV works for simple domain lists with explicit column mapping in the wizard.
IOC vs IP allowlist?
Allowlist is explicit permit; IOC blocklist is deny. Allowlist wins on conflict—show overlap warning, never silent override.
Feed triggers automation?
Yes—webhook on new Critical IOC can run enrichment or notify SOC; destructive blocks still need approval if workflow touches accounts.
Member-visible blocks?
Rarely explain IOC source—generic “connection blocked for security” with link to IT status; no threat actor attribution to end users.
Retention for expired IOCs?
Archive, don’t delete—align with data retention (typically 1–3 years for enforce decisions); include in compliance export.
Next steps
- Design threat hunting queries and investigation workspace UI in Figma — pivot from IOC to multi-event investigation
- Design SIEM log ingestion and data source connectors UI in Figma — correlate sightings with feed indicators
- Design security automation and response workflows UI in Figma — auto-enrich or block on new Critical IOC
- Design IP allowlist and network restrictions UI in Figma — prevent allowlist/blocklist conflicts
- Design security posture dashboard and compliance checklist UI in Figma — feed hygiene and FP rate KPIs
§ Keep reading