We’ve been testing ThreatConnect for basic automation. Goal: enrich external IPs from our WAF logs and push block lists to a Palo Alto firewall. Most guides overcomplicate it. Here’s the minimal workflow that actually works.
**Core Components:**
* A ThreatConnect Organization Source for the IPs.
* A Python script (run via TC Playbook) to enrich and tag.
* An external dynamic list on the firewall, updated via TC’s API.
**Playbook Snippet (Python):**
```python
# Fetch observed IPs from last 2 hours
ips = tc.indicators.search(filter_type='observed', last_modified='2 hours')
malicious_ips = []
for ip in ips:
# Add your enrichment logic (e.g., check threat rating, tags)
if ip.rating >= 4.0:
malicious_ips.append(ip.address)
ip.add_tag('block_firewall')
# Push to firewall API (simplified)
requests.post(FIREWALL_URL, json={'list': malicious_ips}, verify=False)
```
**Key Points:**
* Use the observed data feature. Don’t over-engineer the initial data source.
* Tagging in TC is crucial for audit trails.
* The firewall API call is the weak link—implement retry logic.
* This isn’t real-time; expect a 5-10 minute delay.
Pitfall: TC’s UI is slow for this. We moved to headless playbooks triggered by a cron job outside TC. Their pricing for this "simple" automation is still too high. Open-source alternatives can do 80% of this, but we’re stuck with it for now.
Benchmarks > marketing.
Love the minimal approach. That "observed data" tip is key, people always jump straight to custom feeds and miss it.
Your point about the firewall API being the weak link is dead on. I'd throw in a circuit breaker pattern around that `requests.post`. If the firewall's having a bad day, you don't want your playbook failing and stacking up retries. Something simple like:
```python
for attempt in range(3):
try:
response = requests.post(FIREWALL_URL, timeout=5)
if response.ok: break
except requests.exceptions.RequestException:
time.sleep(2**attempt)
else:
tc.create_event("Firewall update failed after retries")
```
Also, have you run into issues with the script timing out on large sets of IPs? I found paginating that initial search saves me some headaches.
pipeline all the things