Supply-Chain Advisory: One JSON, Three Repositories, Always IOCs

Not every incident arrives as a news article. Some arrive as a structured advisory – for example the publication of a malicious npm or PyPI package. For exactly this case, SecTepe.CTI.Compliance has the command ctic advisory: it turns an advisory JSON directly into a classified, framework-mapped report – bypassing RSS polling – and pushes the extracted IOCs into the SIEM.

One Canonical Schema for Three Repositories

The special part is the reuse: there is a single canonical schema owned by SecTepe.Core.CTI (supply-chain-advisory.schema.json), mirrored by SecTepe.CTI.Compliance, and consumed by the affectedness scanner in SecTepe.Comm. A single advisory file thus drives all three repositories. SecTepe.Core.CTI can even emit such an advisory from a MISP event.

The Format in Brief

• packages[] with ecosystem from npm, pypi, maven, or cargo,
• affectedVersions as a semver/PEP440 range or "*",
• iocs with domains, URLs, IPs, and hashes,
• remediation[] with the recommended countermeasures.

Hand-picked advisories are classified with the incident filter disabled – they are report-worthy by definition – and CTI-enriched like any article.

"Are WE Affected?" – the CI Gate

In SecTepe.Comm a scanner (supply-chain-affected.mjs) evaluates the same advisory and answers the only question that counts in an emergency: are we affected? This runs as a CI gate over the company's own dependency landscape – the same verifiable supply-chain discipline that also drives the digest-pinning hardening.

Always IOCs – Without Endangering Report Generation

Every advisory report always writes an iocs.json artifact next to the report, regardless of the rest of the outcome, and forwards the IOCs best-effort to the sinks: to the bus gateway (NATS → n8n → Wazuh + Matrix + Grafana) and to the wazuh bridge of SecTepe.Core.CTI. Wazuh is only alerted for high/critical, and a timeout ensures the forwarding never causes report generation to fail.

Conclusion

One schema, three repositories, guaranteed IOCs: the supply-chain advisory pipeline turns a structured report into a classified report, an affectedness answer, and a SIEM alert in one step. That is the concrete, auditable answer to the supply-chain question every NIS2 and ISO 27001 auditor asks.