Solving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTW
summary
Company OpenCTI instance accumulates 7 million entities and 10 million relationships from 50,000 external reports ingested over three years by 50+ researchers, producing ~200 messy sector labels with duplicates and misspellings that must map to STIX 2.1 (34 sectors) or CISA (16). Pipeline uses SpaCy and Flair and experiments with LLMs, so the team dumps sectors, plans API-driven merges, logs every change, and argues to extend STIX 2.1 to capture needed granularity.
AI-written summary · about
chapters (9)
- 0:00CTI data challenges
- 4:46Building the OpenCTI system
- 7:13Ingestion pipeline design
- 8:44The importance of sectors
- 10:22Data quality issues
- 12:36Canonicalizing data
- 14:21Developing a custom schema
- 16:44Platform maintenance risks
- 18:51Future improvements
related talks
29mA Collective CTI Doctrine
30mHow to Create Effective Structured Intelligence Extensions for TIPs
30mCTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard Ecosystem
32mOperational Efficiency in CTI: A Blueprint for SME's Using Open-Source AI and Cognitive Automation
31mSkynet the CTI Intern: Building Effective Machine Augmented...
01h 01mIntroduction To STIX/TAXII 2 Standards
25mDisparate Data, Distorted Decisions: Vendor Data Bias in CTI
27mIndicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing