A TOG (threat intelligence gateway) is a hardware piece that sits between the router and the firewall. The TIG uses the threat intelligence and filters out the malicious urls and IPs before reaching the firewall.
My question is how I can build one, what are the parts of a TIG in terms of hardware, How can I build one that is not expensive?
My question is how I can build one, what are the parts of a TIG in terms of hardware,
Welcome to the world of "market speak" where vendors try to make improvements sound like something entirely new.
Threat intelligence isn't about hardware, it's more of a service. It is about "threat intelligence" and the ability to deliver this intelligence quickly and widely so action can be taken. You can use "threat intelligence" with many NGFW, NGIPS, or other security devices.
The key point is that someone somewhere is collecting information (from devices associated to their threat intelligence system as well as other sources) and when threats are found, they are able to push out a means of remediation to the associated devices in real time.
How can I build one that is not expensive?
Since the key element of threat intelligence is a service and not hardware, the reality is that you need to subscribe to a service and have hardware that the chosen service supports. And because often their remediation methods are using some intensive analytics, the hardware resources required can be steep.
If you are looking for a similar solution on the cheap, look into an IDS/IPS solution like Snort. They provide regular updates to their IDS/IPS rulesets, but you still need to download and apply the rulesets in some fashion (often this is automated in some way to take place several times per day). Note, that unless you pay for a subscription, the rules available to you will be 30 days old before you can download them.
