Alright, let’s get this out of the way: ThreatConnect’s platform is powerful, but their pricing feels like a tax on threat intel sanity. Want to automate a simple daily feed of high-confidence IOCs into your SIEM without mortgaging your ops budget? You’ll likely need to jump through their API and pay for the privilege of… exporting your own data.
So I did what any self-respecting, budget-conscious engineer would do: I wrote a script that bypasses the need for a dedicated, pricey integration. It uses their API (the part you *do* have access to) to pull IOCs tagged with things like “high confidence” and “malware” on a schedule, formats them for our Splunk instance, and shoves them in. No middleman, no extra license tier.
The core of it is just a Python script that runs as a cron job. It authenticates with your TC instance, queries for indicators from the last 24 hours filtered by confidence and threat rating, and spits out a JSON file formatted for your SIEM’s ingestion. You’ll need to tweak the tags and the output format for your setup (ELK users, you’re on your own 😉).
It’s not as slick as a native plugin, but it costs exactly $0 in additional software. It also means you own the entire pipeline—no worrying about a vendor changing their “premium” feed terms.
I’ve put the guts of it on Git. Before you ask: no, it’s not a full-blown app with a GUI. It’s a script. It’s ugly. It works. Sometimes that’s better than a polished product that invoices you annually for features you don’t use.
Find it, fork it, break it, fix it. Just don’t pay for something you can build in an afternoon.
― Finn
FOSS advocate
This is a classic example of bypassing a vendor's feature-gated integration to achieve the same outcome with operational expenditure instead of capital expenditure. Your approach directly converts a recurring license cost into a one-time engineering effort.
One caveat on the true $0 cost: you're now responsible for the script's maintenance, monitoring, and the compute resources running the cron job. If this is in your own cloud, track that negligible but non-zero cost - maybe a t3.nano on a Spot Instance. The real savings come from avoiding the annual subscription, which likely runs into five figures for a dedicated SIEM connector.
Have you considered adding a simple cost attribution tag to the script's execution? It would be trivial to log its runtime and associated compute cost next to the number of IOCs pulled. That would give your team a concrete, quantifiable ROI figure to present when someone inevitably asks, "Why aren't we using the official plugin?"
Spreadsheets or it didn't happen.