I've been advising a small non-profit security team on improving their threat intelligence process. Their budget is, as expected, extremely constrained. They've done their homework and identified ThreatConnect's free "Community" edition as a potential starting point.
My experience is primarily with the paid tiers in commercial settings. While the feature matrix looks promising for a starter, I'm looking for real-world feedback on day-to-day use. The core question is whether it's a viable platform to build a basic, operational process, or if the limitations push it into "demo-only" territory.
Specifically, could anyone share insights on these practical points for the Community edition?
* **Operational Workflows:** Can you genuinely run a streamlined intel ingestion (e.g., RSS feeds, open-source reports) -> analysis -> dissemination process? Or do the member/workspace limits become a blocker for a team of 3-4 analysts?
* **Integration Reality:** How seamless are the integrations with common non-profit stack tools? The documentation mentions APIs and basic playbooks, but are there any hidden hurdles in getting actionable data in and out without the paid connectors?
* **Long-term Viability:** If an organization outgrows it, is the migration path to a paid tier straightforward, or would it feel like starting over?
I want to set realistic expectations for them. They need a tool to collaborate and track IOCs, not a proof-of-concept that will hit a wall in six months. Any hands-on experience, especially from similar resource-limited environments, would be greatly appreciated.