CASE STUDY · THREAT INTELLIGENCE PLATFORMS
Building a threat intelligence feed aggregator for an MSSP.
- 40%Alert noise down 40%
- 30%Analysts triage about 30% faster
01 · PROJECT OVERVIEW
The client and the brief.
An anonymised managed security provider. Name withheld under confidentiality.
An event pipeline with deduplication, enrichment and transparent scoring. Indicators from every feed pass through the same stages and reach analysts as one ranked list with the reasoning attached.
- 1The provider subscribed to many threat feeds, commercial, open-source and a few shared by customers.
- 2The same indicator often arrived from five sources in five formats.
- 3Analysts worked through long lists, many entries repeated or outdated, and had no clear way to judge which ones mattered for a particular customer.
- 4Good alerts were buried.
- 5New analysts took a long time to learn which feeds to trust.
02 · WHAT WENT WRONG
What went wrong, and how we fixed it.
Every engagement hits problems. These were the ones that mattered here, and what we changed so they did not come back.
- PROBLEM 01Our first scoring model rewarded indicators seen in many feeds
That turned out to favour popular but stale indicators, which several feeds copied from each other. Analysts spotted it in the second review. We added a source-independence check, so feeds known to republish the same upstream data count once, and added decay so older indicators lose weight.
- PROBLEM 02This cost about a week and made the ranking noticeably more trusted
- PROBLEM 03A second hurdle came from enrichment
One external source limited how many lookups we could make, and a burst of new indicators used the quota in an hour. Later indicators arrived unenriched and were scored too low. We added a queue with priority for indicators already tied to a customer's assets, a cache for repeated lookups, and a clear "not yet enriched" state so analysts could see the gap instead of trusting a weak score.
- PROBLEM 04We added a queue with priority for indicators already tied to a customer's assets, a cache for repeated lookups, and a clear "not yet enriched" state so analysts could see the gap instead of trusting a weak score
03 · THE PROCESS
How we ran it.
We worked in three phases with a small team. The first weeks went on discovery: shadowing analysts, listing every feed, and measuring how much they overlapped. Next we built the pipeline in vertical slices, one feed at a time, and demoed to analysts every second Friday so they could correct us early. The final phase covered tuning against live data, with a weekly review of the scoring rules led by the client's senior analyst. We kept a shared backlog and met the client lead twice a week.
- 01Step 1
We worked in three phases with a small team.
- 02Step 2
The first weeks went on discovery: shadowing analysts, listing every feed, and measuring how much they overlapped.
- 03Step 3
Next we built the pipeline in vertical slices, one feed at a time, and demoed to analysts every second Friday so they could correct us early.
- 04Step 4
The final phase covered tuning against live data, with a weekly review of the scoring rules led by the client's senior analyst.
- 05Step 5
We kept a shared backlog and met the client lead twice a week.
04 · RESULTS
What changed.
Measured against the way the work ran before the engagement began.
- NOW 01
Analysts start from a ranked list, not raw feeds.
- NOW 02
Every score can be explained in a sentence.
- NOW 03
The senior analyst reviews scoring rules monthly and changes them through a recorded process.
- NOW 04
New feeds are tested for overlap and value before being paid for.
- 40%
Alert noise down 40%
- 30%
Analysts triage about 30% faster
05 · WHAT WE BUILT
How it works.
- Ingestion: one connector per feed, each writing raw events to a queue with the source and received time.Failures retry with back-off and raise an alert if a feed goes silent.
- Normalisation: a common indicator model covering type, value, source, confidence, first-seen and last-seen.
- Deduplication: indicators are matched on normalised values, then merged, keeping every source and its timestamps.
- Enrichment: context is added from internal and external sources, with caching to respect rate limits.
- Scoring: a rule-based score combining source reliability, age, number of independent sources and relevance to each customer's industry and assets.Every score stores the reasons.
- Delivery: ranked lists and API endpoints feeding the provider's detection tools.
06 · QUICK ANSWERS
The short version.
- What problem did the client have?
- The provider subscribed to many threat feeds, commercial, open-source and a few shared by customers. The same indicator often arrived from five sources in five formats. Analysts worked through long lists, many entries repeated or outdated, and had no clear way to judge which ones mattered for a particular customer. Good alerts were buried. New analysts took a long time to learn which feeds to trust.
- What did Brandsmashers build?
- An event pipeline with deduplication, enrichment and transparent scoring. Indicators from every feed pass through the same stages and reach analysts as one ranked list with the reasoning attached.
- How was the work run?
- We worked in three phases with a small team. The first weeks went on discovery: shadowing analysts, listing every feed, and measuring how much they overlapped. Next we built the pipeline in vertical slices, one feed at a time, and demoed to analysts every second Friday so they could correct us early. The final phase covered tuning against live data, with a weekly review of the scoring rules led by the client's senior analyst. We kept a shared backlog and met the client lead twice a week.
- What were the results?
- Alert noise down 40%; analysts triage about 30% faster.
YOUR TURN
Have a similar requirement?
Tell us what is stuck. We will come back with a plan and matched, pre-vetted engineers.
