Cisco’s analytics platform can’t ingest a threat feed — so indicators get pasted in by hand and never cleaned out. This is how a tangled customer pipeline became a clean tool that keeps detection honest by actively forgetting.
A security team subscribes to a threat-intelligence feed full of botnet C2 servers, malware droppers, ransomware infrastructure — the places your network should never be talking to. The team runs Cisco Secure Network Analytics, which can alert on traffic to a known-bad host group. But SNA can’t ingest a threat feed: no TAXII client, no API connector, no scheduled import. So someone pastes IPs into a host group by hand — and once they’re in, nobody takes them out. Threat intel has a shelf life. A C2 server gets seized, an IP gets reassigned to a coffee shop’s WiFi, and last month’s protection becomes this month’s false positive.
This is the story of snabridge, the second tool out of Nimentus.
The thing worth saving was 20% of what existed
snabridge started from a real automation a customer had built for exactly this problem: CSV exports, cloud storage triggers, serverless functions, a CI pipeline, email bolted on the side. It worked — and it was welded to that customer’s entire cloud estate. Buried in the plumbing was one genuinely hard, valuable piece: the reconciliation logic that gets indicators into SNA correctly. The first real decision was the most important one: don’t copy the pipeline. Extract the idea, throw away the rest, and do a clean-room rebuild of the one part that mattered.
Why “correctly” is the whole problem
In SNA, a host group holds a list of IP ranges — and there is no “add one IP” or “remove one IP.” Updating a group replaces its entire list in one shot. That single fact forces the design: you can’t think in additions. You compute the complete desired state for each group and overwrite it with exactly that. The feed isn’t a stream of additions — the feed is the desired state.
That’s what turns stale intel from a chore into something the tool just does. An indicator dropping out of the feed automatically clears from SNA on the next run. Retirement isn’t a feature; it’s a side effect of being honestly declarative.
The empty-state guard
“The feed is the complete desired state” has a sharp edge: a feed outage, taken literally, means “every group should contain nothing” — one clean, confident, catastrophic wipe of your detections. So snabridge refuses. An empty result is treated as suspicious, and the tool won’t retire everything unless you explicitly tell it you mean it. Eager to protect, reluctant to tear down.
Pluggable feeds, behind one honest interface
Feeds are adapters: each fetches from one kind of source and maps it to “here are the groups and the raw IPs in each.” The core handles validation, diffing, and SNA. The first adapter pulls ThreatFox, grouped by malware family — AsyncRAT C2s in one SNA group, Cobalt Strike in another. The second unlocks everything else: TAXII 2.1, the standard protocol of the threat-intel ecosystem, validated against a live OpenCTI instance. One adapter, many sources.
The bugs that only the real thing could teach
Every meaningful bug surfaced against live infrastructure, never a mock. The SNA manager refuses HTTP/1.1 outright — 505s until the entire HTTP layer was swapped for one speaking HTTP/2. On-prem appliances run self-signed certificates, so verification became a deliberate, documented option. And a TAXII URL pointing one path segment shy of the API root produced nothing but an opaque parsing error — so the fix was teaching the tool to detect that mistake and say so in plain language. None of these were in the algorithm; they were in the seam between clean code and messy reality.
Review, then apply
snabridge never applies blind. Every run produces a plan — a full diff, including the groups about to be retired — and nothing touches SNA until a human approves it. The approval is deliberately all-or-nothing: cherry-picking which retirements to skip would reintroduce exactly the stale-indicator problem the tool exists to kill.
From engine to product
snabridge ships as Docker images — API-and-core plus a web GUI — in whatever topology your network demands. The container generates its encryption keys once on first run and persists them to a volume, which quietly killed the most painful lesson of the build: twice during development I lost a key that lived only in a shell session. The structure removes the failure mode.
Where it is now
Snabridge runs end to end: pull from ThreatFox or any TAXII 2.1 source, diff against live SNA state, show a human the plan, and on approval reconcile — additions and retirements alike. It installs on a fresh server in minutes and is configured entirely from the browser. The satisfying part isn’t the feature list — it’s that useful logic trapped in one company’s plumbing is now a clean, open tool anyone can pick up. That’s the whole idea behind Nimentus.
Leave a Reply