Beyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence
summary
An AWS CIRT team builds a hybrid threat data extraction tool that combines deterministic DFS parallel processing over CloudTrail CSVs with an embeddings + LLM pruning layer to produce ranked kill chains and natural‑language summaries. The pipeline processes ~990 million CloudTrail records in about 25 minutes, turning weeks or months of manual log triage into minutes, with validation via custom models and human‑in‑the‑loop checks. Key tradeoffs: accuracy versus throughput, token cost, data privacy, and designing for production scale.
AI-written summary · about
chapters (20)
- 0:00AI in cyber threat intelligence
- 1:09AI security tool lessons learned
- 2:58Business needs for automation
- 5:24AI personas explained
- 6:49Threat data extraction case study
- 8:14CloudTrail logs analysis
- 9:56Threat technique catalog for AWS
- 10:36AI enhancement layer deep dive
- 13:28AI for manual log analysis
- 14:30AI integration measurements
- 15:55System permissions security
- 16:15Speed accuracy ground truth balance
- 17:18AI data privacy trust
- 17:40Trust frameworks adoption
- 18:22POC to production scaling
- 19:05Hybrid AI cost considerations
- 20:14Human judgment vs automation
- 20:56AI tools security risks
- 21:17Key takeaways recommendations
- 22:44Q&A
related talks
48mHunting Stealth Adversaries with Graphs & AI
27mSimplify compliance and security investigations with generative AI
21mDefending at Machine Speed: Technology’s New Frontier
51mCyber threat intelligence sharing on AWS
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
01h 00mData is out, knowing is in: Applying AI to automate cloud operations
32mFrom Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF
40mApplying Artificial Intelligence to the Incident Response Function