The excess or absence of information available today combined with the lack of automation makes incident handling a huge challenge. IntelMQ was created for a constant improvement of feed processing so it can support the work of incident response teams. IntelMQ was developed by FCCN (Fundação para a Computação Científica Nacional) and was later supported by other European CSIRTs with the aim of speeding up the treatment of information and improve the tool through shared development. Through the collection and processing of feeds it is possible to filter molded data for the desired purpose. This workshop intends to provide the trainees with the following skills: [+]Understanding the IntelMQ framework [+]Installing and configuring IntelMQ [+]Understanding the structure of a bot [+]Feed IntelMQ with Kippo SSH Honeypot