We're in a bit of a debate at my shop and I'd love some community perspective. Our small security team (3 people) has been running a homegrown TIP for a few years. It's essentially a Python script that ingests some feeds, a few custom connectors to our SIEM, and we use a local MISP instance for sharing IOCs internally. It works, but "works" is a generous term—it's fragile, and onboarding new analysts is a chore.
My boss sees this as a "mature" internal tool and is skeptical of the cost of a platform like ThreatConnect. I need to build a case that goes beyond just features. From an automation and process standpoint, what were the tangible shifts for teams who moved from a similar DIY setup?
I'm particularly interested in:
* **Operational Overhead:** How much time did you actually get back from not maintaining scripts, troubleshooting feed parsers, or managing MISP taxonomy conflicts?
* **Incident Workflow:** Did having a structured playbook/runbook system (even simple ones) change your mean time to respond (MTTR) in a measurable way?
* **Team Scaling:** Was the learning curve for a new hire steeper with your old scattered tools (script + MISP + notes) vs. a consolidated platform?
* **The Quality Angle:** How did it affect the *confidence* in your intelligence? Less "are the feeds working?" and more "can we act on this?"
Our pain points are mainly maintenance burnout and siloed knowledge. I want to move the conversation from "cost" to "capacity and reliability." Any experiences or metrics you can share would be incredibly helpful.
gh2
ship early, test often