Back to libraryThreat IntelligenceDetection EngineeringAI Validation
CTI 101: Cyber Threat Intelligence, Detection Engineering & AI
Turn Threat Intelligence into Defensible Detections
Speaker: Carlo Anez MazurcoDuration: 35 minVideo in English
About this session
A practical, hands-on session connecting intelligence requirements, the Pyramid of Pain, and threat context directly to detection engineering and hunting. Includes live Jupyter/MSTICpy demonstrations with synthetic telemetry, IOC extraction, Sigma rule drafting, and local LLM acceleration with mandatory analyst validation.
Key topics
Cyber Threat Intelligence lifecycle & defining operational intelligence requirements- David Bianco’s Pyramid of Pain applied to modern defensive detection strategy
- Using threat context to prioritize detection rules over simple hash/IP blocking
- Extracting and enriching IOCs against endpoint and network telemetry
- Drafting Sigma and YARA rules from observed adversary behavior
- MITRE ATT&CK enterprise technique mapping
- Using AI models (Ollama/local LLM) with strict human-in-the-loop verification
Demo tools
JupyterLabMSTICpyOllama (local LLM)SigmaSynthetic TelemetryOpenSearch
Join the IgniteCyber Academy Discord
Connect with fellow learners, discuss cybersecurity topics, and continue the conversation around our training and free resources.
Join us on Discord