building-ioc-enrichment-pipeline-with-opencti

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow queries external threat intelligence APIs such as VirusTotal, Shodan, and AbuseIPDB to enrich IOCs, where external actors can control returned metadata fields that are ingested into the pipeline.