Skynet the CTI Intern: Building Effective Machine Augmented...
summary
A CTI workflow integrates OpenAI (conversational API), LangChain, nltk, GitHub Copilot and regexes to process vendor articles and MITRE ATT&CK mappings for a continuous threat exposure platform. Automated one‑paragraph summaries replace the old NLP pipeline and go live (summary generation operational). ISO‑3166 demonym lists are generated as quick one‑offs. ATT&CK technique extraction is hit‑and‑miss and needs more prompting work (attack extraction mixed success). Programmatic STIX2 object merging surprisingly returns valid STIX2 JSON and may be operationalized (stix2 merging unexpectedly successful).
AI-written summary · about
chapters (11)
- 0:00Introduction and setup
- 1:04Speaker introduction and expectations
- 4:15Problem and automation motivation
- 7:28Summary generation experiment
- 11:03One-off data generation
- 14:18Attack technique extraction
- 20:04STIX 2 object merging
- 24:23Code assistant with AI
- 25:25Experimentation results summary
- 26:50Future of CTI and interns
- 27:33Q&A session
related talks
16mSoK: Automated TTP Extraction from CTI Reports – Are We There Yet?
26mImproving Cybersecurity Posture with an AI Security Assistant
32mWhy AI Will Not Take Our CTI Analyst Jobs (But We Should Befriend the Machines, Anyway)
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
32mOperational Efficiency in CTI: A Blueprint for SME's Using Open-Source AI and Cognitive Automation
29mThe Blueprint for Enduring Actionable CTI
54mA Practical Guide to AI Threats & Mitigation Strategies
43mRedefining Human-AI Collaboration