A method comprising: receiving, by a rule provider device external to a first network protected by a packet filtering device, network threat intelligence reports from a plurality of different network-threat-intelligence providers (130, 132, 134), wherein the plurality of different network-threat-intelligence providers are external to the first network; generating, by the rule provider device, a plurality of packet filtering rules based on the network threat intelligence reports received by the rule provider device; receiving, by the packet filtering device and from the rule provider device, the plurality of packet filtering rules, the plurality of packet filtering rules configured to cause the packet filtering device to identify packets corresponding to at least one of a plurality of network-threat indicators, wherein the plurality of network-threat indicators comprise Internet network addresses associated with one or more hosts (136, 138, 140); responsive to a determination, by the packet filtering device, that a first packet corresponds to criteria specified by a first packet filtering rule of the plurality of packet filtering rules based on one or more network-threat indicators specified by the first packet filtering rule: applying, by the packet filtering device and to the first packet, an operator specified by the first packet filtering rule and configured to cause the packet filtering device to allow the first packet to continue toward a destination of the first packet; communicating, by the packet filtering device and to the rule provider device, data indicating that the first packet was allowed to continue toward the destination of the first packet; receiving, by the rule provider device, a new network threat intelligence report from at least one of the plurality of different network-threat-intelligence providers; generating, by the rule provider device, an update to at least one packet filtering rule based on the new network threat intelligence report; receiving, by the packet filtering device and from the rule provider device, the update to at least one packet filtering rule; modifying, by the packet filtering device and based on the received update to the at least one packet filtering rule, the first packet filtering rule to reconfigure the packet filtering device to prevent packets corresponding to the one or more network-threat indicators from continuing toward their respective destinations; and responsive to a determination, by the packet filtering device, that a second packet corresponds to criteria specified by the modified first packet filtering rule: preventing, by the packet filtering device and based on at least one operator specified by the modified first packet filtering rule, the second packet from continuing toward a destination of the second packet. receiving, by a rule provider device external to a first network protected by a packet filtering device, network threat intelligence reports from a plurality of different network-threat-intelligence providers (130, 132, 134), wherein the plurality of different network-threat-intelligence providers are external to the first network; generating, by the rule provider device, a plurality of packet filtering rules based on the network threat intelligence reports received by the rule provider device; receiving, by the packet filtering device and from the rule provider device, the plurality of packet filtering rules, the plurality of packet filtering rules configured to cause the packet filtering device to identify packets corresponding to at least one of a plurality of network-threat indicators, wherein the plurality of network-threat indicators comprise Internet network addresses associated with one or more hosts (136, 138, 140); responsive to a determination, by the packet filtering device, that a first packet corresponds to criteria specified by a first packet filtering rule of the plurality of packet filtering rules based on one or more network-threat indicators specified by the first packet filtering rule: applying, by the packet filtering device and to the first packet, an operator specified by the first packet filtering rule and configured to cause the packet filtering device to allow the first packet to continue toward a destination of the first packet; communicating, by the packet filtering device and to the rule provider device, data indicating that the first packet was allowed to continue toward the destination of the first packet; receiving, by the rule provider device, a new network threat intelligence report from at least one of the plurality of different network-threat-intelligence providers; generating, by the rule provider device, an update to at least one packet filtering rule based on the new network threat intelligence report; receiving, by the packet filtering device and from the rule provider device, the update to at least one packet filtering rule; modifying, by the packet filtering device and based on the received update to the at least one packet filtering rule, the first packet filtering rule to reconfigure the packet filtering device to prevent packets corresponding to the one or more network-threat indicators from continuing toward their respective destinations; and responsive to a determination, by the packet filtering device, that a second packet corresponds to criteria specified by the modified first packet filtering rule: preventing, by the packet filtering device and based on at least one operator specified by the modified first packet filtering rule, the second packet from continuing toward a destination of the second packet.