Just built a simple webhook receiver for RF alerts to avoid vendor lock-in.

Hey folks! Been neck-deep in our Recorded Future setup for threat intel feeds, and while the data is great, I started getting that familiar vendor lock-in itch. We were routing all RF alerts directly into our SIEM and a couple of other tools, but what if we wanted to switch or add a custom processor later? The native integrations are convenient, but you can get stuck.

So I spent an afternoon building a simple, containerized webhook receiver to act as a middleware. It gives us a single, controlled entry point for all RF alerts. Now we can parse, filter, or reroute the JSON payloads to anywhere we want (our own S3 data lake, a different SIEM, a Slack channel for critical stuff) without touching the RF config again. It's basically a cheap "adapter" pattern for our threat intel.

Here's the core of the Flask app (it's running in ECS Fargate behind an ALB, super cheap):

```python
@app.route('/webhook/rf-alerts', methods=['POST'])
def handle_rf_alert():
if not verify_signature(request.headers.get('X-RF-Signature'), request.data):
abort(403)

alert_data = request.get_json()

# Basic filtering: only forward high-risk items
if alert_data.get('riskScore', 0) > 80:
# Send to internal SNS topic for fan-out
sns_client.publish(
TopicArn=os.environ['SNS_TOPIC_ARN'],
Message=json.dumps(alert_data)
)
# Also log the full payload to S3 for audit
s3_client.put_object(
Bucket=os.environ['AUDIT_BUCKET'],
Key=f"alerts/{datetime.utcnow().isoformat()}.json",
Body=json.dumps(alert_data)
)

return jsonify({"status": "processed"}), 200
```

The beauty is in the decoupling. Our internal systems now subscribe to the SNS topic, not to Recorded Future directly. If we ever change our SIEM or want to try a different intel feed, we just update the subscribers in one place. No more reconfiguring API keys and webhooks in the RF portal for every little change.

Cost is basically zero (Fargate + SNS is pennies), and we get full control over the data flow. Anyone else doing something similar? I'm curious about how you might be handling alert enrichment or deduplication at this layer before it hits your primary security tools.