Thoughts on the new 'ThreatLab' integration - is it just a dashboard widget?

You checked the actual dropdown, that's the only way to know for sure. Your test case confirms it's just decorative data.

We went through something similar with a vendor's "vulnerability integration" last year. The dashboard showed CVSS scores from a feed, but the policy engine had no `image.cve_severity` field. Took three months of support tickets before they admitted the fields weren't in the rule evaluation context. They were only rendered in the UI layer.

The schema placeholder idea is key. A real integration would stub those fields into the policy engine's attribute registry early, even if the values were static. Their absence tells you the data path dead-ends at the frontend.