Supply-Chain Advisory: One JSON, Three Repositories, Always IOCs

Not every incident shows up as a news article. Some come as a structured advisory. One example is the release of a malicious npm or PyPI package. For just this case, SecTepe.CTI.Compliance has the command ctic advisory. It turns an advisory JSON straight into a classified report, mapped to frameworks. It skips RSS polling. And it pushes the IOCs it pulls out into the SIEM.

One Shared Schema for Three Repositories

What makes it special is reuse. There is one canonical schema (supply-chain-advisory.schema.json). SecTepe.Core.CTI owns it. SecTepe.CTI.Compliance keeps a mirror of it. And the scanner in SecTepe.Comm that checks who is affected reads it. So one advisory file drives all three repositories. SecTepe.Core.CTI can even create such an advisory from a MISP event.

The Format in Brief

• packages[] with ecosystem set to npm, pypi, maven, or cargo,
• affectedVersions as a semver/PEP440 range or "*",
• iocs with domains, URLs, IPs, and hashes,
• remediation[] with the steps we advise you to take.

Hand-picked advisories are classified with the incident filter turned off. By definition, they are worth a report. Like any article, they get CTI enrichment.

"Are WE Affected?" The CI Gate

In SecTepe.Comm, a scanner (supply-chain-affected.mjs) reads the same advisory. It answers the only question that counts in an emergency: are we affected? It runs as a CI gate over all of the company's own dependencies. This is the same supply-chain rigor, one you can check, that also drives the digest-pinning hardening.

Always IOCs, Without Putting the Report at Risk

Each advisory report always writes an iocs.json artifact next to the report. That happens no matter how the rest turns out. It then forwards the IOCs best-effort to two sinks:

• the bus gateway (NATS → n8n → Wazuh + Matrix + Grafana),
• the wazuh bridge of SecTepe.Core.CTI.

Wazuh only gets an alert for high/critical. A timeout makes sure the forwarding can never make the report fail.

Conclusion

One schema, three repositories, and IOCs every time. The supply-chain advisory pipeline turns a structured advisory into three things in one step: a classified report, an answer on whether you are affected, and a SIEM alert. That is a clear answer you can audit to the supply-chain question every NIS2 and ISO 27001 auditor asks.