OpenTide: From Raw Intelligence to Structured Threat-Informed Detections
summary
OpenTide turns raw CTI into validated detection assets by modeling atomic threat vectors, bundling them into detection objectives, and rendering concrete detection as code rules. It uses JSON schemas, Git-native CI/CD pipelines and autonomous coding agents to cut manual conversion from hours to about 15 minutes, deploys to Sentinel Defender Splunk CrowdStrike Arfong Lab, and ships a data inventory and surface vocabulary. Over 200 threat vectors are public, the system runs two years in production, and agent outputs match or exceed fatigued human reviewers.
AI-written summary · about
chapters (14)
- 0:00OpenTide framework intro
- 1:27Threat intel vs detection gap
- 4:46Why ATT&CK isn't enough
- 7:20OpenTide design & architecture
- 9:07Core Threat & OpenTide projects
- 10:09Detection objective & rule model
- 13:22Map threats to objectives
- 14:49Detection objectives explained
- 16:13Detection as code workflow
- 16:55Agent Tide AI detections
- 19:47Raw intel to detections
- 21:31Works for humans & agents
- 22:13Skills framework & future
- 23:18Resources & Q&A
related talks
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
20mDynamic Defense: Crafting threat models with real-world Intelligence
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
47mDetection as Code: The Engineering-Focused Future...
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities