Besides incoming blacklisted connections, external to internal traffic isn't super useful in any of our analysis modules. And incoming blacklisted connections is of questionable usefulness as well since the things that normally scan everything on the internet will also normally end up on blacklists. We're not trying to detect someone attacking coming in. We're trying to detect already compromised

Most .py files use #!/usr/bin/python3 as shebang, but few others use #!/usr/bin/env python3.

Files which use #!/usr/bin/env python3:

./contrib/eventdb/common.py
./intelmq/bin/intelmq_generate_misp_objects_templates.py
./intelmq/tests/bots/parsers/github_feed/test_parser.py

These files should use #!/usr/bin/python3 for the sake of consistency.

"AA03": { "description": "Weakness in SSO Authorization", "source": (Process, Element), "target": (Process, Server), "condition": "target.implementsAuthenticationScheme is False", },

What if the Process implements BasicAuth or uses mutual TLS (neither of which is SSO)?
If the Process uses SAML or OAuth, then maybe.
Maybe authenticationScheme as a string var is neces