threat-intelligence-feed

name	threat-intelligence-feed
description	Automated CVE and threat intelligence aggregation, prioritization, and patch tracking for the Security department. Scans vulnerability databases, threat feeds, and dependency reports. Ranks threats by exploitability × impact, tracks patch SLAs, and feeds the security self-improvement loop. Use when scanning for vulnerabilities, triaging CVEs, tracking patch compliance, or running the security UAOP pipeline.
risk	low
tags	["security","vulnerability","threat-intel","compliance"]
created	2026-03-23T00:00:00.000Z
updated	2026-03-23T00:00:00.000Z

Threat Intelligence Feed — Security Intelligence Engine

Automated vulnerability discovery, prioritization, and patch lifecycle management. UAOP Stage 1 + Stage 5 for the Security department.

When to use

• Daily CVE scanning and triage
• After a new CVE advisory is published
• Before releases — "are we exposed?"
• Quarterly security posture review
• When a dependency update is available

When NOT to use

• Active incident response (use production-monitoring + incident-responder)
• Code-level security review (use security-review)
• Penetration testing (use offensive-security)

Pipeline

Step 1: Scan Sources

Collect threat data from available sources:

SCAN TARGETS:
  Dependencies:
    - Python: requirements.txt, pyproject.toml → check against OSV/NVD
    - Node: package.json, package-lock.json → check against npm audit
    - Docker: base images → check against Trivy DB
    - Terraform: provider versions → check against HashiCorp advisories

  Infrastructure:
    - AWS services in use → check against AWS security bulletins
    - Container images → Trivy scan results
    - IaC configs → Checkov/Semgrep findings

  External feeds (via WebSearch):
    - NIST NVD recent CVEs for our stack (Python, FastAPI, PostgreSQL, Redis, Next.js)
    - GitHub Security Advisories for our dependencies
    - OWASP updates relevant to our attack surface

Tools: WebSearch (CVE lookups), github MCP (security advisories), filesystem (scan configs)

Step 2: Prioritize by Risk

RISK SCORE = Exploitability × Impact × Exposure

  Exploitability (1-10):
    10 = Public exploit available, trivial to execute
     7 = POC exists, requires some skill
     4 = Theoretical, no public exploit
     1 = Requires physical access or highly unlikely conditions

  Impact (1-10):
    10 = RCE, data breach, full system compromise
     7 = Privilege escalation, data exposure
     4 = DoS, information disclosure (non-sensitive)
     1 = Minor information leak, cosmetic

  Exposure (1-10):
    10 = Internet-facing, no auth required
     7 = Internet-facing, behind auth
     4 = Internal only, behind VPN
     1 = Development-only, not in production

Step 3: Classify and Assign SLAs

Tier	Risk Score	SLA	Action
CRITICAL	700-1000	Patch within 1 hour	Page oncall, emergency patch
HIGH	400-699	Patch within 24 hours	Create urgent PR, fast-track review
MEDIUM	100-399	Patch within 7 days	Add to sprint, normal review
LOW	1-99	Patch within 30 days	Backlog, batch with other updates

Step 4: Produce Threat Report

# Threat Intelligence Report — [Date]

## Scan Summary
- Sources scanned: [N]
- New vulnerabilities found: [N]
- By severity: [N] CRITICAL, [N] HIGH, [N] MEDIUM, [N] LOW
- Overdue patches: [N]

## CRITICAL Findings (Action Required NOW)
| CVE | Component | Risk Score | Exploitability | Impact | SLA | Status |
|-----|-----------|-----------|---------------|--------|-----|--------|

## HIGH Findings (Action Required Within 24h)
[same format]

## Patch Compliance Dashboard
| Tier | Total | Patched On Time | Overdue | Compliance % |
|------|-------|----------------|---------|-------------|
| CRITICAL | [N] | [N] | [N] | [X]% |

## Dependency Health
| Package | Current | Latest | CVEs | Risk | Action |
|---------|---------|--------|------|------|--------|

## Trend (Last 30 Days)
| Metric | Last Month | This Month | Delta |
|--------|-----------|------------|-------|
| Mean Time to Patch (CRITICAL) | [X]h | [Y]h | [+/-Z]h |
| Vulnerability escape rate | [X]% | [Y]% | [+/-Z]% |
| False positive rate | [X]% | [Y]% | [+/-Z]% |

Step 5: Self-Improvement Loop (UAOP Stage 5)

MEASURE:
  - Patch SLA compliance (% patched on time per tier)
  - False positive rate (threats flagged that weren't real)
  - Escape rate (vulnerabilities that reached production undetected)
  - MTTP trend (mean time to patch over time)

REINFORCE:
  - Scanning rules that caught real threats → increase priority
  - Sources with high false positive rates → reduce weight or filter
  - Components with recurring vulnerabilities → flag for replacement

REGENERATE:
  - Update scanning scope based on new components/dependencies
  - Adjust risk scoring weights based on actual exploit attempts
  - Feed findings into security/rules.md for policy updates

Cadence

DAILY:   Automated dependency scan (Trivy, npm audit)
WEEKLY:  Full threat report with CVE triage
MONTHLY: Security posture review + trend analysis
QUARTERLY: Comprehensive audit + policy review

Agents

Agent	Role
security-engineer (L2)	Owns threat triage, sets patch priorities
security-auditor (L3)	Executes scans, analyzes findings
compliance-officer (L3)	Tracks SLA compliance, generates evidence
legal-compliance-checker (L5)	Validates regulatory alignment

Tools

Tool	Purpose
WebSearch	CVE database lookups, threat feed scanning
github MCP	Security advisory monitoring, dependency alerts
filesystem MCP	Read dependency files, scan configs
sequential MCP	Multi-step risk analysis and prioritization
memory MCP	Store threat patterns, track historical data