Hey folks, hoping to tap into the collective wisdom here. I've been deep in the infrastructure and security automation world for a while, primarily using tools like Ansible and Vault to harden our own systems. Lately, there's been a big push from leadership to get a better handle on our third-party and supply chain risks. We're evaluating platforms, and ThreatConnect is on the list for its threat intelligence capabilities.
My specific question is whether anyone has successfully extended ThreatConnect beyond internal TI feeds and use cases to actively monitor and assess third-party risk. I'm thinking about scenarios like:
* Ingesting and scoring intelligence on vendors (e.g., breach reports, vulnerability disclosures, geopolitical exposure).
* Automating the enrichment of our vendor inventory with TI from ThreatConnect.
* Creating workflows that trigger alerts or review tickets when a vendor's "risk score" in ThreatConnect changes.
I'm particularly interested in the practical, "how-we-glued-it-together" aspects. Did you use the API extensively? Was the out-of-the-box functionality sufficient, or did you need to build a lot of custom integrations? Any major pitfalls in mapping third-party entities (domains, IPs, company names) into the ThreatConnect data model?
If you've gone down this path, I'd love to hear about your architecture. For example, did you build something like this?
```python
# Example pseudo-code for a custom integration
import threatconnect
def assess_vendor(vendor_domain):
tc = threatconnect.ThreatConnect()
indicators = tc.get_indicators(owner='Vendor_Intel', query=vendor_domain)
risk_score = calculate_score(indicators) # Your custom logic
update_cmdb(vendor_domain, risk_score) # Sync to your inventory
if risk_score > threshold:
create_service_now_ticket(vendor_domain)
```
I'm trying to gauge if this is a square-peg-in-a-round-hole situation, or if ThreatConnect's flexibility makes it a viable core for a third-party risk program. Any insights on licensing, required modules (like Playbooks), or performance at scale with thousands of vendors would be incredibly helpful.
Thanks in advance for sharing your experiences and war stories!
—John
Keep it simple.