<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-threat-intelligence-workflows
description: >-
  Automate threat intelligence ingestion, normalization, enrichment, scoring,
  and distribution across SIEM, EDR, and firewall infrastructure using STIX/TAXII
  feeds, VirusTotal, MISP, and AbuseIPDB APIs.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - threat-intelligence
  - stix
  - taxii
  - misp
  - virustotal
  - enrichment
  - ioc
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Automating Threat Intelligence Workflows

## Overview

Threat intelligence automation ingests indicators from multiple feeds, normalizes
to STIX 2.1 format, enriches with multi-source correlation, scores by relevance
and confidence, and distributes to defensive infrastructure. This eliminates
manual IOC management and reduces time-to-block for emerging threats.

Mode: `[MODE: BLUE]` — Automated intelligence operations.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `stix2` | Required |
| VirusTotal API key (community or premium) | Required |
| MISP instance with API access or AbuseIPDB key | Required |
| SIEM API for indicator push (Splunk, Elastic) | Required |

## Key Concepts

### Feed Ingestion

```python
import requests

def fetch_otx_pulses(api_key: str, days: int = 7) -> list[dict]:
    """Fetch recent OTX pulses."""
    resp = requests.get(
        "https://otx.alienvault.com/api/v1/pulses/subscribed",
        headers={"X-OTX-API-KEY": api_key},
        params={"modified_since": f"{days}d"},
        timeout=30,
    )
    resp.raise_for_status()
    return resp.json().get("results", [])
```

### Multi-Source Enrichment

```python
def enrich_ip(ip: str, vt_key: str) -> dict:
    """Enrich IP indicator with VirusTotal data."""
    resp = requests.get(
        f"https://www.virustotal.com/api/v3/ip_addresses/{ip}",
        headers={"x-apikey": vt_key},
        timeout=15,
    )
    if resp.status_code == 200:
        data = resp.json()["data"]["attributes"]
        return {
            "ip": ip,
            "malicious_votes": data.get("last_analysis_stats", {}).get("malicious", 0),
            "country": data.get("country", "unknown"),
            "asn": data.get("asn", 0),
            "reputation": data.get("reputation", 0),
        }
    return {"ip": ip, "error": f"VT lookup failed: {resp.status_code}"}
```

### Indicator Scoring

```python
def score_indicator(enrichment: dict) -> float:
    """Calculate threat score (0.0-1.0) from enrichment data."""
    score = 0.0
    malicious = enrichment.get("malicious_votes", 0)
    if malicious >= 10:
        score += 0.6
    elif malicious >= 5:
        score += 0.4
    elif malicious >= 1:
        score += 0.2
    reputation = enrichment.get("reputation", 0)
    if reputation < -50:
        score += 0.3
    elif reputation < -10:
        score += 0.1
    return min(score, 1.0)
```

## Workflow

### Step 1: Ingest Feeds

```bash
node scripts/agent.js --action ingest --feed otx --days 7
```

### Step 2: Enrich Indicators

```bash
node scripts/agent.js --action enrich --ioc 185.220.101.1 --source virustotal
```

### Step 3: Score and Distribute

```bash
node scripts/agent.js --action score --input /tmp/ti/indicators.json
```

## Verification

- [ ] Feed ingestion returns normalized indicators with timestamps
- [ ] Multi-source enrichment adds context from at least two sources
- [ ] Scoring produces consistent values for known-bad indicators
- [ ] Distribution pushes indicators to SIEM within SLA

## References

- [STIX 2.1 Specification](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)
- [VirusTotal API v3](https://docs.virustotal.com/reference/overview)
- [MISP API Documentation](https://www.misp-project.org/openapi/)
- [OTX DirectConnect API](https://otx.alienvault.com/api)
