ThreatIntelGPT: STIX from Chaos
summary
Shows that ChatGPT and OpenAI API can extract IOCs and relationships from PDFs, images and code and emit STIX 2.1 objects that load into viewers, then auto-generate Splunk detections and Sigma rules. Uses GPT-3/4 family, LangChain, retrieval augmented generation and local options like GPT4All and Llama. Works at scale but hits practical limits: model knowledge drift, data licensing and security, token costs (now up to 128,000 tokens ≈100,000 words) and occasional fine‑tuning needs; a Sigma training example cost about $0.25.
AI-written summary · about
chapters (7)
- 0:00AI and threat intelligence
- 4:17AI in cyber threat intel
- 7:08STIX with LLMs
- 13:16Scaling CTI extraction
- 17:55Retrieval for CTI
- 22:29Training CTI AI models
- 24:57Q&A
related talks
49mChatGPT: A New Generation of Dynamic Machine Based Attacks?
44mAI Foundations: Mitigate Risks and Boost SOC Efficiency
32mSecurity Implications of Artificial Intelligence Synthesizers
58mSTOIC Security: Shielding Your Generative AI App from the Five Deadly Risks
46mUsing AI in Software Design: How ChatGPT Can Help With Creating a Solution Arch.
39mThreat Modeling Using LLMs
01h 07mEmpowering Security Teams with Generative AI
30mBattling the Machine: Cutting-Edge Attacks and Defenses in Generative AI