How to Improve Your Threat Intelligence Process with AIL Project
summary
AIL is an open source Python framework that CIRCL uses to collect, crawl and structure terabyte‑scale leaks and web content, with modular Playwright browsers for realistic crawling, Telegram and custom feeders, and a lacus backend for automated screenshots and cookie/session harvesting of Tor markets. It extracts patterns (IBANs, credentials), applies YARA/Sigma‑style rules, correlates duplicates and trending CVE mentions, attaches evidence and exports standardized MISP bundles. It runs on‑prem (two+ machines for operational Tor crawling) and is production proven.
AI-written summary · about
chapters (14)
- 0:00AIL Project introduction
- 3:36Threat intelligence at CIRCL
- 6:25CTI collection requirements
- 10:20Automating Telegram data collection
- 13:14Extracting selectors from leaks
- 14:57Correlating CTI duplicates
- 16:21Automated intelligence tagging
- 17:27Tracking vulnerabilities in CTI
- 19:13Taxonomies and Galaxy in AIL
- 20:18Structured intelligence reports
- 21:47Refining detection rules
- 23:11AIL in CTI workflows
- 24:37AIL open-source nature
- 25:32Q&A
related talks
25mORKL: Building an Archive for Threat Intelligence History
23mPython for Threat Intelligence
40mWhat Does an LLM-Powered Threat Intelligence Program Look Like?
37mThreat Intelligence Library - A New Revolutionary Technology to Enhance the SOC Battle Rhythm!
51mCyber threat intelligence sharing on AWS
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
27m"Cybertelligence": How AI is changing the face of cybersecurity