Architecting Threat Intelligence with Clojure in Cybersecurity Detection & Response
summary
Claims Clojure code ingests and transforms threat feeds into an Elasticsearch document DB via JSON and powers a production Extended Detection & Response platform; open source repos (CTIM and a CTI API) implement the model and access layer. Architecture handles massive funnels of telemetry and external feeds, emphasizes provenance for reputation lookups (who said it, when, for how long), and uses Clojure transformers to normalize varied models—deployed in production and servicing XDR workflows.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:47Stop Clicking Links
- 1:10Why Cybersecurity
- 2:47Threat Intelligence Architecture
- 3:42Cisco Threat Intelligence Model
- 4:26What is Threat Intelligence
- 5:11Sources of Threat Intelligence
- 6:33Threat Intelligence Models
- 7:37Data Engineering Principles
- 9:45Extra Tips
- 10:52Exercise
- 12:01Wrap up
related talks
38mBuilding a Legal Data Service with Clojure
27mUnbundling the electronic health record using Clojure
43mDoing Data Science with Clojure
46mData, Models and Clojure
20mDynamic Defense: Crafting threat models with real-world Intelligence
33mClojure Dispatches From a National Research Lab
25mORKL: Building an Archive for Threat Intelligence History
40mClojure Emerging Data Ecosystem