Threat Intelligence Feed

Threat Intelligence Feed — Security Intelligence Engine

Automated vulnerability discovery, prioritization, and patch lifecycle management. UAOP Stage 1 + Stage 5 for the Security department.

When to use

• Daily CVE scanning and triage
• After a new CVE advisory is published
• Before releases — "are we exposed?"
• Quarterly security posture review
• When a dependency update is available

When NOT to use

• Active incident response (use production-monitoring + incident-responder)
• Code-level security review (use security-review)
• Penetration testing (use offensive-security)

Pipeline

Step 1: Scan Sources

Collect threat data from available sources:

SCAN TARGETS:
  Dependencies:
    - Python: requirements.txt, pyproject.toml → check against OSV/NVD
    - Node: package.json, package-lock.json → check against npm audit
    - Docker: base images → check against Trivy DB
    - Terraform: provider versions → check against HashiCorp advisories

  Infrastructure:
    - AWS services in use → check against AWS security bulletins
    - Container images → Trivy scan results
    - IaC configs → Checkov/Semgrep findings

  External feeds (via WebSearch):
    - NIST NVD recent CVEs for our stack (Python, FastAPI, PostgreSQL, Redis, Next.js)
    - GitHub Security Advisories for our dependencies
    - OWASP updates relevant to our attack surface

Tools: WebSearch (CVE lookups), github MCP (security advisories), filesystem (scan configs)

Step 2: Prioritize by Risk

RISK SCORE = Exploitability × Impact × Exposure

  Exploitability (1-10):
    10 = Public exploit available, trivial to execute
     7 = POC exists, requires some skill
     4 = Theoretical, no public exploit
     1 = Requires physical access or highly unlikely conditions

  Impact (1-10):
    10 = RCE, data breach, full system compromise
     7 = Privilege escalation, data exposure
     4 = DoS, information disclosure (non-sensitive)
     1 = Minor information leak, cosmetic

  Exposure (1-10):
    10 = Internet-facing, no auth required
     7 = Internet-facing, behind auth
     4 = Internal only, behind VPN
     1 = Development-only, not in production

Step 3: Classify and Assign SLAs

Step 4: Produce Threat Report

# Threat Intelligence Report — [Date]

## Scan Summary
- Sources scanned: [N]
- New vulnerabilities found: [N]
- By severity: [N] CRITICAL, [N] HIGH, [N] MEDIUM, [N] LOW
- Overdue patches: [N]

## CRITICAL Findings (Action Required NOW)
| CVE | Component | Risk Score | Exploitability | Impact | SLA | Status |
|-----|-----------|-----------|---------------|--------|-----|--------|

## HIGH Findings (Action Required Within 24h)
[same format]

## Patch Compliance Dashboard
| Tier | Total | Patched On Time | Overdue | Compliance % |
|------|-------|----------------|---------|-------------|
| CRITICAL | [N] | [N] | [N] | [X]% |

## Dependency Health
| Package | Current | Latest | CVEs | Risk | Action |
|---------|---------|--------|------|------|--------|

## Trend (Last 30 Days)
| Metric | Last Month | This Month | Delta |
|--------|-----------|------------|-------|
| Mean Time to Patch (CRITICAL) | [X]h | [Y]h | [+/-Z]h |
| Vulnerability escape rate | [X]% | [Y]% | [+/-Z]% |
| False positive rate | [X]% | [Y]% | [+/-Z]% |

Step 5: Self-Improvement Loop (UAOP Stage 5)

MEASURE:
  - Patch SLA compliance (% patched on time per tier)
  - False positive rate (threats flagged that weren't real)
  - Escape rate (vulnerabilities that reached production undetected)
  - MTTP trend (mean time to patch over time)

REINFORCE:
  - Scanning rules that caught real threats → increase priority
  - Sources with high false positive rates → reduce weight or filter
  - Components with recurring vulnerabilities → flag for replacement

REGENERATE:
  - Update scanning scope based on new components/dependencies
  - Adjust risk scoring weights based on actual exploit attempts
  - Feed findings into security/rules.md for policy updates

Cadence

DAILY:   Automated dependency scan (Trivy, npm audit)
WEEKLY:  Full threat report with CVE triage
MONTHLY: Security posture review + trend analysis
QUARTERLY: Comprehensive audit + policy review

Agents

Tools