Agentic Cyber Defense with External Threat Intelligence
summary
An autonomous agentic pipeline ingests WHOIS, GeoIP and VirusTotal feeds, extracts deterministic features (domain age, country, thread hits) and LLM-derived signals, then scores and explains risk — the demo computes a static risk score of 1.7 for example.com and outputs a verdict of no malicious activity observed. The system runs as a Streamlit app orchestrated with LangChain, uses gpt-4 and 3.5-turbo for tool selection and explanations, stores feedback in a memory DB, and monitors with Prometheus/Grafana.
AI-written summary · about
chapters (8)
- 0:00Agentic cyber defense
- 3:22LLMs for cybersecurity
- 11:47Threat data and features
- 14:57Architecture for threat intel
- 17:05Live demo: threat intel system
- 20:49Scaling production
- 25:03Future possibilities
- 26:09Q&A
related talks
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
30mCybersecurity Risk Assessment Using LLM Agents and Graph Data Science
30mTrawling for IOCs: Catching C2 in a Sea of Data
26mImproving Cybersecurity Posture with an AI Security Assistant
52mAI in Cybersecurity & Fraud Prevention
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...