FIRST Cyber Threat Intelligence Symposium 2022
2022-11-01..2022-11-03
Berlin, Germany
who it's for
cyber threat intelligence analysts, threat intelligence managers, security operations center analysts, digital forensics investigators, malware reverse engineers, CTI platform engineers
topics
MISP instance fleet management; MITRE ATT&CK mapping and tracking; threat landscape one-page briefs; Timesketch timeline pruning; STIX-based TIP extensions; code-search for malware binaries; targeted web skimming investigations; CTI-driven DFIR workflows; feed deduplication and enrichment; threat intelligence archive search; analyst burnout and automation
| title | author | length |
|---|---|---|
| Ten Years of Cyber Threat Intelligence: Retrospectives | James Chappell | 32m |
Eleven years of CTI are condensed into a claim that intelligence now reduces ignorance by turning data into actionable context: a one-sentence definition is… | ||
| The Joy of Threat Landscaping | Gert-Jan Bruggink | 33m |
Argues that a threat landscape is a living concept to standardize threat language across an org, not a one-off report; recommends starting with stakeholder… | ||
| Cyber Threat Intelligence Analysts and You | John Doyle | 28m |
Introduces the Mandiant Cyber Threat Intelligence Analyst Core Competencies Framework that enumerates skills and maps roles to strategic, operational, and… | ||
| Community Management and Tool Orchestration the Open source Way via Cerebrate | Andras Iklody, Sami Mokaddem | 28m |
Cerebrate is an open source platform (v1.4) that centralizes contact and constituency metadata, automates MISP instance fleet management, and negotiates tool… | ||
| Lets Make Needles Glow in Timesketch | Thomas Chopitea, Alexander Jäger | 28m |
Timesketch integrates threat intelligence to prune massive timelines: a fresh Windows Server 2022 ingest shows 4 million events (3M filesystem, 350k journald… | ||
| How to Create Effective Structured Intelligence Extensions for TIPs | Peter Ferguson | 30m |
Practical guide to building TIP extensions that normalise and route CTI: uses STIX concepts and a real EclecticIQ-style platform, implements feeds, targeted… | ||
| Why Your Security Analysts Are Leaving and What You Can Do to Retain Them | Thomas Kinsella | 35m |
Survey of 500 analysts finds 70% say they’re satisfied yet 47% report severe burnout and about 64% expect to change jobs within 12 months; 82% call their teams… | ||
| CTI Bake-Off: A Recipe for Measuring, Integrating, and Prioritizing a CTI Program | Kellyn Wagner Ramsdell | 30m |
Argues that using ATT&CK as the program core produces measurable, actionable CTI by mapping techniques to NIST 800-53, CVEs, and an Insider Threat Knowledge… | ||
| Enhancing CTI Processes with Code Search Technology | Carlos Rubio, Jonas Wagner | 30m |
A code-search engine that decomposes binaries into functions and does bindiff at scale claims resilient family identification by matching large subsets of… | ||
| ORKL: Building an Archive for Threat Intelligence History | Robert Haist | 25m |
A public, file-based archive gathers ~3,000+ threat intelligence PDFs and stores for each a PDF, plain-text extraction, JSON metadata and cover JPEG, exposed… | ||
| Diamonds are a Forensicator's Best Friend - Intelligence Support for DFIR | Kamil Bojarski | 31m |
Shows how CTI directly guides DFIR by turning artifacts into testable hypotheses: use the diamond model and a FEED/F3EAD-style loop to prioritize searches, run… | ||
| Targeted Web Skimming on E-Commerce Sites | Hendrik Adrian, Takehiko Kogen | 30m |
Claim: attackers implant obfuscated JavaScript into vulnerable e‑commerce templates, load a fake Google API domain to harvest form fields, and exfiltrate… | ||
| nothing matches | ||