If CSIRTs are Knights, CTI Teams are Queens
summary
Claim: a compact, continuously updated CTI feed shortens the CSIRT’s UDA/OODA loop and yields faster containment. Proposal: a lightweight “thread actor resume” dashboard that surfaces an executive summary, trending dirty TTPs (last 5–10 cases), current tooling, and initial‑access trends so responders can run quick hunts with Velociraptor or XDR. Implementation uses existing tooling (Splunk index or equivalent) and a single point of contact, but engineering the ingestion pipeline and feedback loop is unfinished and remains the main obstacle.
AI-written summary · about
chapters (9)
- 0:00CSIRTs and CTI teams intro
- 1:24Cyber battlefield confrontation
- 3:07UDA Loop Sprint in IR
- 6:44CTI support in incidents
- 10:14Reciprocity in CTI-CSIRT
- 14:08UDA Loop with CTI support
- 17:33TarB dashboard design
- 22:51Real-time CTI integration challenges
- 24:55Conclusion and key takeaways
related talks
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
26mSpin Your CTI Process Round
29mA Collective CTI Doctrine
17mIncident Response @ Scale-Building a Next Generation SOC
32mTen Years of Cyber Threat Intelligence: Retrospectives
28mFrom 2017 to 2021: Integration of an Operational Situation Awareness Team to a CSIRT...
04h 02mOpen-source Tools for CSIRTs