A method comprising: receiving, by a packet-filtering appliance configured to process packets in-transit traversing a boundary between a first network and a second network, a plurality of packet-filtering rules each indicating a criterion and an action to be performed, wherein: the packet-filtering rules were determined based on a plurality of threat indicators that were determined based on cyber threat intelligence reports of a plurality of cyber threat intelligence providers, and a first packet-filtering rule of the plurality of packet-filtering rules indicates a first criterion and that an action is to be determined after an in-transit packet matching the first packet-filtering rule is received; receiving, by the packet-filtering appliance from the first network and at a first time, a first in-transit packet destined to the second network; based on determining that the first in-transit packet matches the first criterion of the first packet-filtering rule, the packet-filtering appliance: determining first threat context information associated with the receiving the first in-transit packet; determining, based on the first threat context information, a first action; and applying the first action to the first in-transit packet; receiving, by the packet-filtering appliance from the first network and at a second time, a second in-transit packet destined to the second network; and based on determining that the second in-transit packet matches the first criterion of the first packet-filtering rule, the packet-filtering appliance: determining second threat context information associated with the receiving the second in-transit packet, wherein the second threat context information has at least one value different from the first threat context information; determining, based on the second threat context information and independently from the determining the first action, a second action; and applying the second action to the second in-transit packet. receiving, by a packet-filtering appliance configured to process packets in-transit traversing a boundary between a first network and a second network, a plurality of packet-filtering rules each indicating a criterion and an action to be performed, wherein: the packet-filtering rules were determined based on a plurality of threat indicators that were determined based on cyber threat intelligence reports of a plurality of cyber threat intelligence providers, and a first packet-filtering rule of the plurality of packet-filtering rules indicates a first criterion and that an action is to be determined after an in-transit packet matching the first packet-filtering rule is received; the packet-filtering rules were determined based on a plurality of threat indicators that were determined based on cyber threat intelligence reports of a plurality of cyber threat intelligence providers, and a first packet-filtering rule of the plurality of packet-filtering rules indicates a first criterion and that an action is to be determined after an in-transit packet matching the first packet-filtering rule is received; receiving, by the packet-filtering appliance from the first network and at a first time, a first in-transit packet destined to the second network; based on determining that the first in-transit packet matches the first criterion of the first packet-filtering rule, the packet-filtering appliance: determining first threat context information associated with the receiving the first in-transit packet; determining, based on the first threat context information, a first action; and applying the first action to the first in-transit packet; determining first threat context information associated with the receiving the first in-transit packet; determining, based on the first threat context information, a first action; and applying the first action to the first in-transit packet; receiving, by the packet-filtering appliance from the first network and at a second time, a second in-transit packet destined to the second network; and based on determining that the second in-transit packet matches the first criterion of the first packet-filtering rule, the packet-filtering appliance: determining second threat context information associated with the receiving the second in-transit packet, wherein the second threat context information has at least one value different from the first threat context information; determining, based on the second threat context information and independently from the determining the first action, a second action; and applying the second action to the second in-transit packet. determining second threat context information associated with the receiving the second in-transit packet, wherein the second threat context information has at least one value different from the first threat context information; determining, based on the second threat context information and independently from the determining the first action, a second action; and applying the second action to the second in-transit packet.