I decided to learn Node around Node 8 and this was a good project for it. I added a few cool things like an async job queue for uploading / importing data since STIX objects can get big. I built out validation and a management UI that weren't part of the spec. Once this moved to a work project we started building out a roles system and a review process for approving content changes. We had a few different teams interested in this internally, but eventually the content delivery mechanism for our adversary simulation work changed requirements and other interested parties left so the project was archived.

One of the things that initially surprised me was how fractured CTI was (and continues to be). I think we share indicators decently well, but nobody outside of MITRE was sharing full STIX-ified records of attacks. I realize that this thinking was naive in that the level of effort to structure data in this way is high and more commonly threat intelligence reports are in natural language. Attack Flow attempted to solve some of this but uptake is limited and I think the verbosity and academic nature have led to only the most devoted teams sticking with it.