Billions of Indicators, Zero Action: How We Fixed That
summary
Organizations start with billions of indicators and under 10% becoming action; the team builds a modular microservice CTI pipeline that enriches indicators, sandboxes Telegram samples automatically, and pushes high‑confidence IOCs straight to CN and EDR blocklists, cutting time to block from six hours to five minutes and false positives from ~30% to ~3%. The system uses trust scoring to filter noise, a self-healing pipeline of plugins to avoid API breaks, and a feedback loop that raises confidence and pivots to related campaign indicators.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:18Indicators never triggering action
- 5:08Traditional CTI cycle failure
- 8:32Modular automated CTI pipeline
- 10:43Security operations center brain
- 11:23Confidence-based dissemination
- 12:52Automated proactive defense
- 13:54Malware analysis automation
- 16:06Results from automated CTI
- 17:13Lessons from automation
- 18:42Start small scale automation
- 19:48Close intelligence action gap
- 20:54Q&A
related talks
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
37mAutomatic Extraction of Indicators of Compromise for Web App.
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
17mCreating Threat Intelligence Signals in a “Zero Trust” Environment
55mCyber Security vs. Statistics
30mTrawling for IOCs: Catching C2 in a Sea of Data
22mTechnical Tracks
49mEvaluating Indicators as Composite Objects