Design Threat Intelligence Platform - System Design | WinJob

Problem Statement and Threat Intelligence Mission

Design anchors (1)

Separate feed ingestion (pull/push) from enforcement planes (WAF, NGFW, EDR) so vendor outages do not stall blocking.
Score every indicator with provenance-weighted confidence; low-confidence IOCs land in monitor-only mode.
Enforce TLP and tenant ACL at query time, not only at ingest—prevents accidental RED spill to wrong consumer.

Mechanism detail

Commercial STIX/TAXII bundles, MISP communities, and internal SOC sightings converge into a canonical indicator store. Each IOC carries type, confidence, TLP, MITRE technique tags, and expiry—never a flat IP list. Pipeline stages remain idempotent on feed_id + stix_id + modified. When Active IOCs exceeds planned 180M, autoscaler adds ingest consumers before scoring backpressure propagates to TAXII pollers.

Failure drills

If feed Feed sources stalls >30s, continue with last-good manifest (TTL 6h) and raise feed_degraded metric. If Push latency p95 lag exceeds SLO, shed lowest-tier enrichments first—never drop block-list generation for score ≥85. If scoring promotion fails validation, keep prior score_version and page detection engineering. If Redis shard is unavailable, serve previous bloom generation with stale=true flag to adapters.

Cost and capacity

At 180M Active IOCs, partition Kafka by tenant and indicator type; chargeback on active IOCs and egress manifest bytes.

Signal	Target
Active IOCs	180M
Feed sources	420
Push latency p95	45s
Tenants	2.8K

javaOne Dark Pro

1 public record IndicatorKey(String tenantId, String type, String value) {
2   public String cacheKey() { return tenantId + ":" + type + ":" + value; }
3 }

pythonOne Dark Pro

1 def merge_score(existing: float, incoming: float, corroboration: int) -> float:
2     boost = min(12.0, corroboration * 2.5)
3     return max(existing, incoming) + boost

typescriptOne Dark Pro

1 export interface PushManifest {
2   version: number;
3   generatedAt: string;
4   shardEtags: string[];
5 }
6  
7 export function shouldBlock(score: number, threshold: number): boolean {
8   return score >= threshold;
9 }

Why interviewers care

Threat Intelligence Platform interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and Threat Intelligence Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Commercial STIX/TAXII bundles, MISP communities, and internal SOC sightings converge into
•Metrics: Active IOCs, Feed sources, Push latency p95
•Separate feed ingestion (pull/push) from enforcement planes (WAF, NGFW, EDR) so vendor out

1	public record IndicatorKey(String tenantId, String type, String value) {
2	public String cacheKey() { return tenantId + ":" + type + ":" + value; }
3	}

1	def merge_score(existing: float, incoming: float, corroboration: int) -> float:
2	boost = min(12.0, corroboration * 2.5)
3	return max(existing, incoming) + boost

1	export interface PushManifest {
2	version: number;
3	generatedAt: string;
4	shardEtags: string[];
5	}
6
7	export function shouldBlock(score: number, threshold: number): boolean {
8	return score >= threshold;
9	}