ORKL: Building an Archive for Threat Intelligence History
summary
A public, file-based archive gathers ~3,000+ threat intelligence PDFs and stores for each a PDF, plain-text extraction, JSON metadata and cover JPEG, exposed via a REST API and a React UI; ingestion uses Casanova (crawler), Apache Tika for PDF parsing, Go + Postgres backend, Swagger docs and Meilisearch for full-text search, files keyed by SHA1. The system maps actor aliases and measures relevance with TF-IDF, keeps original source references, and plans crowdsourced curation plus an NLP pipeline for automated report filtering.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 1:31The problem with CTI data
- 4:24Project architecture
- 5:26How the library manager works
- 9:36Data sources and inspirations
- 12:03API and data model details
- 17:40Tech stack and implementation
- 18:53Roadmap and call to action
related talks
37mThreat Intelligence Library - A New Revolutionary Technology to Enhance the SOC Battle Rhythm!
27mHow to Improve Your Threat Intelligence Process with AIL Project
26mDeath to the IOC: What's Next in Threat Intelligence
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
27mThe Role of ThreatExchange
30mProcessing Threat Reports at Scale Using AI and ML: Expectations and Reality
13mArchitecting Threat Intelligence with Clojure in Cybersecurity Detection & Response
31mFiltering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence