Volver a la bibliotecaThreat IntelligenceDetection EngineeringAI Validation
CTI 101: Cyber Threat Intelligence, Detection Engineering & AI
Turn Threat Intelligence into Defensible Detections
Ponente: Carlo Anez MazurcoDuración: 35 minVideo en inglés
Sobre esta sesión
A practical, hands-on session connecting intelligence requirements, the Pyramid of Pain, and threat context directly to detection engineering and hunting. Includes live Jupyter/MSTICpy demonstrations with synthetic telemetry, IOC extraction, Sigma rule drafting, and local LLM acceleration with mandatory analyst validation.
Temas clave
Cyber Threat Intelligence lifecycle & defining operational intelligence requirements- David Bianco’s Pyramid of Pain applied to modern defensive detection strategy
- Using threat context to prioritize detection rules over simple hash/IP blocking
- Extracting and enriching IOCs against endpoint and network telemetry
- Drafting Sigma and YARA rules from observed adversary behavior
- MITRE ATT&CK enterprise technique mapping
- Using AI models (Ollama/local LLM) with strict human-in-the-loop verification
Herramientas de demostración
JupyterLabMSTICpyOllama (local LLM)SigmaSynthetic TelemetryOpenSearch
Únete al Discord de IgniteCyber Academy
Conecta con otros estudiantes, debatir temas de ciberseguridad y continuar la conversación en torno a nuestra formación y recursos gratuitos.
Únete a Discord