Fetch threat intel feeds and normalize content