Discussion: Integration with Threat Intelligence feeds

Discussion: Threat Intelligence Integration

Overview

This discussion covers potential integration points with threat intelligence feeds to enhance adpentest's detection and reporting capabilities.

Proposed Integrations

1. Known Exploited Vulnerabilities (KEV)

Integrate CISA's Known Exploited Vulnerabilities catalog:

# Auto-highlight CVEs that are actively exploited
{
    \"cve_id\": \"CVE-2022-26923\",
    \"in_cisa_kev\": True,
    \"exploitation_date\": \"2022-05-15\"
}

2. Ransomware Threat Intel

Track which CVEs are used in ransomware campaigns:

• BlackSuit (uses AS-REP roasting)
• LockBit (uses PrintNightmare)
• REvil (uses ProxyLogon chain)

3. APT-Specific Indicators

Link discovered vulnerabilities to known APT groups:

{
    \"apt_groups\": [\"APT1\", \"Lazarus\"],
    \"attack_campaigns\": [\"FIN7\"],
    \"latest_activity\": \"2026-08-15\"
}

4. Vendor Security Advisories

• Microsoft Security Update Guide
• Active Directory security bulletins
• Emergency patches

5. Community Data Sources

• GitHub vulnerability repositories
• Security research blogs
• Twitter/X security feeds

Implementation Options

Option A: Static Feed

• Download latest KEV/threat intel weekly
• Bundle with package
• Update via pip upgrade

Option B: Dynamic Feed

• Real-time API calls to threat intel sources
• Cache results locally
• Fallback to static data on API failures

Option C: Hybrid Approach

• Default static feed
• Optional dynamic feed for detailed scans
• API key configuration for premium sources

Proposed Commands

# Show CVEs exploited in the wild
adpentest --target domain.local --show-exploited

# Risk scoring based on threat intel
adpentest --target domain.local --threat-scoring

# Filter by APT group activity
adpentest --target domain.local --apt-filter \"Lazarus\"

# Latest threat intel summary
adpentest --update-threat-intel
adpentest --threat-intel-report

Benefits

• ✅ Prioritize remediation by real-world threat
• ✅ Understand adversary TTPs
• ✅ Align with CISA advisories
• ✅ Better risk reporting

Challenges

• API rate limits
• Data freshness vs performance
• Privacy/data handling concerns
• Integration complexity

Community Feedback

• Which threat intel sources are most valuable for your org?
• Would you prefer static or dynamic feeds?
• What metrics matter most?
• Any privacy concerns?

Related Projects

• CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Exploit-db: https://www.exploit-db.com/
• Shodan: https://www.shodan.io/

No implementation files, tests, or entry points are named. Start by reviewing the proposed KEV, ransomware, APT, advisory, and community sources and the static, dynamic, and hybrid options; this needs an agreed scope before work can begin. Done means the selected integration approach, data sources, commands, caching or update behavior, and failure handling are specified and implemented.