Arrangements for detecting, evaluating and controlling intelligence threat data feeds are provided. In some examples, a plurality of threat intelligence data feeds may be received. The threat intelligence data feeds may be received and evaluated to identify one or more feeds that are considered to provide valuable information to the entity implementing the evaluation. For instance, the evaluation may identify one or more feeds or providers that provides accurate data, timely data, and the like. In some examples, based on the evaluation, one or more data feeds may be removed (e.g., data might not be received), one or more alerts may be generated or dismissed, alerts generated for potential threats may be prioritized (e.g., alerts generated based on data from more accurate feeds are prioritized over alerts generated based on data from less accurate feeds).