A Collective CTI Doctrine

on YouTube ↗29m

" summary

A federated CTI program builds a 60-rule Doctrine and uses OpenCTI + STIX + MISP to force graph‑based, atomic objects from public blog posts and vendor writeups, converting hundreds of posts into structured indicators and relationships. About 650 people across the CampusCyber communities prototype and share outputs (24 commons produced), the effort takes two years, enforces TLP and PAP tagging, and yields a working central repository that improves analyst time but still needs final governance and licensing rules.

AI-written summary · about

" chapters (7)

1. 0:00Compus Cyber CTI intro
2. 6:12Need for collective CTI
3. 10:25Goals for shared CTI
4. 15:09Methodology for collective CTI
5. 20:32CTI platform selection
6. 24:30Key takeaways
7. 27:42Q&A

" related talks

• 22mSolving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTWPhilippe Lin · 2024 FIRST Cyber Threat Intelligence Conference
• 27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...C. Curelaru · OWASP 20th Anniversary 2021
• 30mHow to Create Effective Structured Intelligence Extensions for TIPsPeter Ferguson · FIRST Cyber Threat Intelligence Symposium 2022
• 30mCTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard EcosystemAlexandre Dulaunoy, Christian Studer · FIRST Cyber Threat Intelligence Conference 2026
• 32mTen Years of Cyber Threat Intelligence: RetrospectivesJames Chappell · FIRST Cyber Threat Intelligence Symposium 2022
• 43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)Prashant Prashant, Pedro Kertzman, Alyssa Hartford, Christopher Scutchings · BSides Edmonton 2025
• 26mScaling cyber threat intelligence sharing with the AUS Cyber Security CenterJess Modini, Jacqui Barr · AWS Summit ANZ 2023
• 28mCyber Threat Intelligence Analysts and YouJohn Doyle · FIRST Cyber Threat Intelligence Symposium 2022