Operational Efficiency in CTI: A Blueprint for SME's Using Open-Source AI and Cognitive Automation

on YouTube ↗32m

" summary

Blueprint promises a runnable CTI stack for cash-strapped SMEs built on OpenCTI, MISP, STIX plus cognitive automation that extracts IoCs and MITRE TTPs via RAG and constrained prompts. Architecture runs LangChain -> Gemma (Gemma 3/4) as the extractor, Gemma model weights on Cloud Run with Nvidia L4, outputs STIX drafts into OpenCTI (RabbitMQ, Python workers, Elasticsearch, Redis, MinIO), uses n8n for ingestion, Terraform/Helm/GitHub Actions for GitOps, human-in-the-loop validation, and reports Cloud Run cost tests of ~$2–3/month vs $500–700 always-on.

AI-written summary · about

" chapters (9)

1. 0:00Introduction and problem
2. 2:18Cognitive defense concepts
3. 7:13From database to apprentice
4. 10:06System architecture overview
5. 14:25Pipeline and AI implementation
6. 20:07Ingestion and validation
7. 22:00Future agentic capabilities
8. 24:22Lessons and closing
9. 28:44Q&A and final thoughts

" related talks

• 31mSkynet the CTI Intern: Building Effective Machine Augmented...Scott J Roberts · BSidesSF 2024
• 29mA Collective CTI DoctrineDavid Bizeul, Fabien Gainier · 2023 FIRST Cyber Threat Intelligence Conference
• 22mSolving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTWPhilippe Lin · 2024 FIRST Cyber Threat Intelligence Conference
• 29mThe Blueprint for Enduring Actionable CTIRoss Rustici · 2023 FIRST Cyber Threat Intelligence Conference
• 27mAI, Innovation, Standards & Scale for Large TelcosSudhir Kumar Mittal · Apidays India 2025
• 32mWhy AI Will Not Take Our CTI Analyst Jobs (But We Should Befriend the Machines, Anyway)Stewart Bertram · 2023 FIRST Cyber Threat Intelligence Conference
• 27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...C. Curelaru · OWASP 20th Anniversary 2021
• 51mCan AI Face Your (Potential) Customers?Alius Petraska · RPA Europe 2024