Prototyping CIFv4 - Engineering a Realtime Intelligence Platform

Prototyping CIFv4 - Engineering a Realtime Intelligence Platform

The main focus of the last ~60 hours has been APIs, feeds and real-time streaming. This includes the HTTP REST API the realtime ZeroMQ streaming API and to some extent, WebHooks…

If you're looking to build and deploy your own #ThreatIntel platform, these are the things you should be thinking about.. It should take months, not years.. and you should learn from our mistakes, not just your own.

Deploying Threat Intel Platforms, From GitHub.

Deploying Threat Intel Platforms, From GitHub.

The problem wasn't trying to manage and automate the code deployment, as much as it became managing the playbooks that deployed the application(s). We could have kept those playbooks in with the core code, but that's more over-head in the repo and more people touching the core code that didn't need to....