2023 FIRST Cyber Threat Intelligence Conference
2023-11-06..2023-11-08
Berlin, Germany
who it's for
cti analysts, threat intelligence managers, misp administrators, incident responders, security operations engineers, chief information security officers, security tool developers
topics
stix 2.1 ingestion and export; misp 3 migration and API compatibility; veris to mitre ATT&CK mappings; retrieval augmented generation for CTI; fine-tuned BART and constrained NLG; siem-to-report content pipelines; automated Sigma rule generation; threat actor case study: Sandworm; federated CTI doctrine and graph sharing; AIL project web and Tor crawling; vulnerability prioritization with contextual CVSS; case management and CTI workflow automation
| title | author | length |
|---|---|---|
| Automating the Junior Analyst: Cyber Security Report Generation with Classic AI | Sergey Polzunov | 21m |
Fabric is a content-generation pipeline that turns SIEM alerts, STIX2 CTI bundles, detection rules and CVE lists into overviews, timelines and briefings using… | ||
| Helping Organizations Anticipate and Approach Emerging Technology Threats | Natalie Kilber | 36m |
Argues that applying NASA TRL maturity levels plus adapted MITRE ATT&CK and diamond-model mappings gives concrete triggers and timelines for emerging-tech… | ||
| If You Want to Build Good Intelligence Requirements, You Do Not Start with Intelligence Requirements | Brian Mohr | 32m |
Argues that useful intelligence starts by mapping stakeholder intended actions and their measures of success, not by making a generic list of requirements… | ||
| MISP 3 - Teaching an Old Dog New Tricks | Andras Iklody, Sami Mokaddem | 30m |
Migration targets a full rework of MISP internals: update the framework to a modern CakePHP stack, refactor the database model and front end, and port features… | ||
| Solving CISO Headaches: How to Align CTI and Risk Management | Jamie Collier (US), John Doyle (Mandiant, US) | 27m |
Claims a practical path to merge CTI and risk: build threat profile documents, map adversary TTPs to the org’s crown jewels, and use a RACI-style racing matrix… | ||
| ThreatIntelGPT: STIX from Chaos | David Greenwood | 28m |
Shows that ChatGPT and OpenAI API can extract IOCs and relationships from PDFs, images and code and emit STIX 2.1 objects that load into viewers, then… | ||
| What is a Threat Actor? Tracking Sandworm's Transformation | Lennart Maschmeyer | 32m |
Tracks Sandworm from black energy (2006) cybercrime roots through a 2015 shift to sabotage (KillDisk) and 2016 adoption of bespoke tools like TeleBots, gcat… | ||
| Why AI Will Not Take Our CTI Analyst Jobs (But We Should Befriend the Machines, Anyway) | Stewart Bertram | 32m |
Argument: current LLMs help but don’t replace CTI roles because hallucinations and lack of provenance make outputs unreliable for high‑stakes attribution and… | ||
| How Much Alert Fatigue Actually is Threat Intel Fatigue? | Markus Ludwig | 22m |
Claims concrete numbers: 25% of analyst time goes to false alerts, 80% report burnout, enterprises use ~17 threat feeds and one tested SIEM shows only 1 of 5… | ||
| A Collective CTI Doctrine | David Bizeul, Fabien Gainier | 29m |
A federated CTI program builds a 60-rule Doctrine and uses OpenCTI + STIX + MISP to force graph‑based, atomic objects from public blog posts and vendor… | ||
| Spin Your CTI Process Round | Andreas Sfakianakis | 26m |
Argues that lacking case management and workflow is the real bottleneck, and shows a working Jira-based workflow (backlog → in progress → ready for four-eyes… | ||
| How to Improve Your Threat Intelligence Process with AIL Project | Alexandre Dulaunoy | 27m |
AIL is an open source Python framework that CIRCL uses to collect, crawl and structure terabyte‑scale leaks and web content, with modular Playwright browsers… | ||
| The Blueprint for Enduring Actionable CTI | Ross Rustici | 29m |
Templates target four deliverables: threat actor report, intrusion analysis report, campaign and executive templates with prescriptive sections and sample… | ||
| VERIS Mappings to ATT&CK - Bridging Risk-based and Ops-focused Incident Classification | David Hylender (US), Philippe Langlois | 24m |
VERIS now maps its incident actions and attributes to MITRE ATT&CK techniques and tactics, created jointly with MITRE CTID and industry partners and published… | ||
| Foresight Analysis: The Magic Eight Ball of Intelligence Analysis | Freddy Murstad | 28m |
Shows a practical program that trains CTI teams to move from reactive, data-driven work to proactive foresight using structured analytic techniques and… | ||
| nothing matches | ||