How do I filter the intel stream to only show threats relevant to our sector?

Hello everyone,

I've been working through a ThreatConnect implementation for a financial services client, and we've hit a common, yet critical, operational hurdle. The platform's strength—its vast and rich stream of intelligence—can also be its biggest challenge for a focused security team. We are being inundated with indicators and reports that, while interesting, have no bearing on our specific vertical. It's creating alert fatigue and causing analysts to potentially miss the needle in the haystack because the haystack is overwhelmingly large.

My goal is to architect a filtering strategy that acts as a force multiplier, ensuring our Tier 1 and 2 analysts are primarily reviewing threats that are *relevant*. I'm looking to move beyond simple keyword matching and build a structured, maintainable approach. Based on my standard vendor evaluation framework for intelligence platforms, I'm considering a multi-layered filter.

Here is my initial procurement playbook for this configuration task:

* **Source and Confidence Weighting:** First, we are evaluating and tiering our intelligence feeds (ISAC/ISAO feeds, open sources, premium providers). We'll assign a base confidence weight to each source and adjust the "relevance score" of any incoming item accordingly.
* **Sector-Specific Tagging & Taxonomy:** We are building a internal taxonomy of keywords and identifiers beyond simple NAICS codes. This includes:
* Threat actor groups known to target financial institutions (e.g., FIN-specific APTs).
* Malware families associated with credential theft and banking trojans.
* Campaign names referenced in FS-ISAC reports.
* Techniques (MITRE ATT&CK) disproportionately used against our sector (e.g., T1486 for ransomware, T1539 for data theft).
* **Dynamic Filtering Rules:** The intent is to create a set of rules in ThreatConnect that combine these elements. For example, a rule might be: "Promote to 'High Priority - Sector Relevant' any Indicator with a confidence > 70 from our FS-ISAC feed that is tagged with both 'Banking' and 'Credential Phishing'."
* **Operationalizing with Groups and Workspaces:** The final step is to direct this filtered stream into a dedicated "Financial Sector Intel" group or workspace. This creates a clean, mission-focused environment for our daily threat briefings and indicator review.

My specific questions for the community are:

* Have you successfully implemented a similar sector-filtering strategy within ThreatConnect? What was the most effective layer of filtering (actor, campaign, technique)?
* How do you manage the ongoing maintenance of your keyword and tag lists? Is this a manual process, or have you automated updates from trusted sector sources?
* In your experience, does creating these strict filters cause you to miss potentially novel or pivoting threats that don't yet have your sector tag?

I'm particularly interested in real-world workflow examples and any pitfalls you encountered during setup. The devil, as always, is in the details of operationalization.