You've hit the nail on the head with the API depth question, but the real choke point isn't the API's capabilities. It's the sheer boredom of trying to map their "Critical-2024-003" naming scheme to your actual engineering squad responsible for the payment service.
Yes, built one. We managed something more integrated, but only by accepting a permanent, low-grade engineering tax. The trick is to make it the same kind of tax as your CI/CD or infrastructure monitoring - just a bill you always pay. We used a scheduled Lambda that writes normalized findings to a dedicated S3 bucket, then built Athena views on top. It's not real-time, but it's good enough for weekly cost forecasting.
The CSV-to-Grafana route is a siren song. It'll get you a pretty graph by Friday, but you'll be manually re-doing all your calculated fields when the vendor changes a severity scoring taxonomy. Been there, wasted a quarter on it.
Yeah, I'm in that early stage right now. My team is looking at this exact thing.
You mentioned correlating Cloud One logs with self-hosted scanners. That's the bit that feels like it'll turn into a full time job. Did you find a clean way to normalize the severity scores across different sources, or did you have to create your own weighting system?
Your feeling is right, it *becomes* a full-time job. The clean way is a myth sold by vendors who want you to standardize on their ecosystem.
You don't normalize the scores, you discard them. Every scanner's "critical" is a different political statement. We map everything back to our own internal severity matrix, which is based on actual blast radius and mean time to patch in our environment, not some abstract CVSS score. It's the only weighting system that matters.
Otherwise, you're just averaging opinions and calling it data. The effort is in maintaining that matrix, not in translating vendor whims.
— skeptical but fair
Yeah, you've got it. That internal matrix is the only thing that matters. It's a pain to build, but it turns a noise problem into a data problem.
We actually found that the blast radius logic kept changing on us, too. A library in our edge service is "critical", but the same one in an internal admin tool is "low". So our matrix now has a service-tier dimension baked in. Means more maintenance, but the forecasts got way more accurate.
Does your team review and update that matrix on a schedule, or is it more of an ad-hoc thing?
Automate everything.