CTI in 2026: the volume problem

A modern CTI team consumes data from 50 to 200 sources: OSINT feeds (OTX, abuse.ch, CIRCL), commercial feeds (Recorded Future, Mandiant, CrowdStrike), CERT advisories (INCIBE, ENISA, CISA), researcher blogs, underground forums, Telegram channels, malware repositories.

The problem is not the lack of data. It is the excess. Every day thousands of new IOCs are published, dozens of threat reports and hundreds of forum posts. A human CTI analyst can read and process between 5 and 10 reports per day if they are detailed. At that pace, 95% of available intelligence goes unprocessed.

AI changes this equation. Not because it is a better analyst than a human (it is not for strategic analysis), but because it can process volume at machine speed and present the human analyst with only what is relevant, already correlated and contextualized.

The intelligence cycle with AI

The classic CTI cycle (direction, collection, processing, analysis, dissemination) does not change with AI. What changes is the speed of each phase:

• Collection: automated crawlers that ingest feeds in real time, parse PDF reports and extract IOCs from blogs.
• Processing: NER to extract entities (IPs, hashes, domains, CVEs, actors), normalization to STIX 2.1, deduplication.
• Analysis: LLMs that correlate IOCs with known campaigns, map to MITRE ATT&CK and generate hypotheses.
• Dissemination: automated report generation in natural language, adapted to the target audience (executive vs technical).

Intelligence feeds and IOCs

Feeds are the raw material of CTI. They are classified by type, cost and quality:

OSINT feeds (free)

• abuse.ch (ThreatFox, MalwareBazaar, URLhaus, Feodo Tracker): the best OSINT source for malware IOCs. ThreatFox has IOCs with context (family, actor, technique). MalwareBazaar has downloadable malware samples.
• AlienVault OTX: community pulses with IOCs and reports. Variable quality (depends on who publishes them).
• CIRCL (MISP feeds): curated feeds by Luxembourg's CERT. High quality, low volume.
• CISA KEV: catalog of actively exploited vulnerabilities. Mandatory for any CTI team.
• PhishTank, OpenPhish: phishing-specific feeds.

Commercial feeds

• Recorded Future: the most comprehensive. Covers OSINT, dark web, paste sites, forums. Expensive (starting at 10K USD/year).
• Mandiant (Google): excellent in APT profiling and malware analysis. Very detailed reports.
• CrowdStrike Falcon Intelligence: strong in threat actor tracking. Proprietary naming (Fancy Bear, Cozy Bear).
• Kaspersky Threat Intelligence Portal: good technical analysis, especially Eastern European malware.

Automated ingestion with AI

The challenge with feeds is that each has its own format: STIX 2.1, CSV, proprietary JSON, RSS, HTML from blogs. An AI-powered ingestion pipeline normalizes everything:

# CTI ingestion pipeline
class CTIIngestor:
    def __init__(self):
        self.parsers = {
            "stix": STIXParser(),
            "csv": CSVIOCParser(),
            "rss": RSSParser(),
            "html": HTMLIntelParser()  # Uses LLM to extract IOCs from blogs
        }

    async def ingest_feed(self, feed: FeedConfig) -> list[IOC]:
        raw_data = await self.fetch(feed.url, feed.auth)
        parser = self.parsers[feed.format]
        iocs = parser.parse(raw_data)

        # Automatic enrichment
        for ioc in iocs:
            ioc.reputation = await self.check_reputation(ioc)
            ioc.mitre_techniques = self.map_to_mitre(ioc)
            ioc.related_campaigns = await self.find_campaigns(ioc)

        # Deduplication against existing database
        new_iocs = self.deduplicate(iocs)
        await self.store(new_iocs)
        return new_iocs

The HTMLIntelParser is where AI shines. Given a researcher's blog post (unstructured text), an LLM automatically extracts: IOCs (IPs, hashes, domains, URLs), TTPs (described attack techniques), mentioned actors and referenced CVEs.

IOC correlation with AI

Correlation is where an isolated IOC becomes actionable intelligence. The question is not "is this IP malicious?" but "what campaign does it belong to, who operates it, who is it targeting, and what does this mean for my organization?"

Infrastructure correlation

Threat actors reuse infrastructure. A C2 domain from today may share registrant, ASN, SSL certificate or naming pattern with domains used months ago. A model trained on infrastructure graphs can detect these connections:

• Passive DNS: historical DNS resolutions. If suspicious.com resolved to the same IP as another domain attributed to APT29, there is a connection.
• SSL certificates: actors using the same certificate or CA for multiple domains.
• Historical WHOIS: same registration data (name, email, organization) across different domains.
• Naming patterns: LLMs can detect lexical patterns in domain names used by the same actor (e.g., brand variations + target industry keywords).

Behavioral correlation (TTPs)

Harder to automate but more valuable. Two campaigns using the same techniques, in the same order, against the same sector, are probably from the same actor even if the infrastructure is completely different.

# TTP correlation with embeddings
def correlate_campaigns(new_campaign, known_campaigns):
    # Generate embedding of the TTP pattern
    ttp_sequence = new_campaign.mitre_techniques  # ["T1566.001", "T1059.001", "T1053.005"]
    new_embedding = model.encode(ttp_description(ttp_sequence))

    # Search for campaigns with similar patterns
    similarities = []
    for known in known_campaigns:
        known_embedding = model.encode(ttp_description(known.mitre_techniques))
        score = cosine_similarity(new_embedding, known_embedding)
        if score > 0.85:
            similarities.append((known, score))

    return sorted(similarities, key=lambda x: x[1], reverse=True)

Threat knowledge graph

The most powerful form of correlation is a knowledge graph where nodes are entities (IOCs, actors, campaigns, malware, vulnerabilities, sectors) and edges are relationships ("uses", "attributed to", "exploits", "targets"). An LLM can populate this graph automatically from textual reports.

Automated MITRE ATT&CK mapping

MITRE ATT&CK is the common language of cybersecurity. Mapping intelligence to ATT&CK enables comparing actors, identifying detection gaps and prioritizing defenses. But manual mapping is slow and subjective.

LLMs for ATT&CK mapping

An LLM can read the description of an attack technique and map it to the correct ATT&CK tactic and technique with precision above 85%. The trick is in the prompt:

MITRE_MAPPING_PROMPT = """
You are a CTI analyst expert in MITRE ATT&CK Enterprise v15.
Given the following text describing a threat behavior,
identify ALL relevant ATT&CK techniques.

Output format (JSON):
{
  "techniques": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access",
      "confidence": "high|medium|low",
      "evidence": "excerpt from the text justifying the mapping"
    }
  ]
}

Rules:
- Use sub-techniques when possible (T1059.001 instead of T1059)
- Include all techniques, not just the main one
- If the description is ambiguous, use confidence "low"
- Do not invent techniques that are not in ATT&CK v15

Text to analyze:
{threat_description}
"""

ATT&CK coverage evaluation

Once your detection rules and IOCs are mapped to ATT&CK, you can visualize your coverage. The ATT&CK Navigator shows you a heatmap of which techniques you detect and which you do not. AI can analyze the gaps and prioritize which rules to create first based on the techniques used by the most relevant actors for your sector.

Threat actor profiling

Actor profiling goes beyond "this group is called APT28 and is Russian." A useful profile includes: motivation, technical capability, target sectors, preferred techniques, typical infrastructure, campaign history and tactical evolution.

Automated profiling with LLMs

An LLM fed with the corpus of public reports on an actor can generate a consolidated profile. The process:

1. Collection: gather all public reports on the actor (Mandiant, CrowdStrike, Kaspersky, researcher blogs, CERTs).
2. Extraction: for each report, extract IOCs, TTPs, victims, infrastructure, timeline.
3. Consolidation: merge data from multiple sources, resolve conflicts (different names for the same actor, contradictory attributions).
4. Profile generation: LLM generates a structured document with standard sections.

Tactical evolution tracking

Actors evolve. APT28 does not use the same techniques in 2026 as in 2020. An AI-powered CTI system can track this evolution:

• New tools adopted (shift from Cobalt Strike to Sliver, or to custom tools).
• Changes in initial access vectors (from spearphishing to VPN exploitation).
• Infrastructure evolution (from VPS to compromised legitimate cloud infrastructure).
• Changes in target sectors (from government to energy sector, for example).

Dark web monitoring

The dark web (Tor, I2P) and underground forums are critical CTI sources. Stolen credentials, zero-day exploits, corporate network access and hacktivist activity are sold and coordinated there.

What to monitor

• Access-selling forums: actors selling RDP, VPN or employee credentials for your organization or sector.
• Ransomware leak sites: where ransomware groups publish stolen data. If your company appears, it is too late to prevent but not too late to respond.
• Paste sites: Pastebin and similar where credential dumps, databases and configurations are published.
• Telegram channels: groups sharing IOCs, tools and coordinating attacks (especially hacktivism).
• Marketplaces: malware-as-a-service, phishing kits, exploits for sale.

AI for dark web intelligence

Manual dark web monitoring is inefficient and risky. AI automates:

• Secure crawling: bots that navigate .onion forums automatically and extract content.
• Translation and NER: many forums are in Russian, Chinese or Arabic. LLMs translate and extract relevant entities.
• Threat classification: differentiating between bravado and real threats. Not everything sold on the dark web is authentic.
• Mention alerts: immediate notification if your organization name, domain, or employee credentials appear.

Automated CTI report generation

A CTI team produces three types of reports, each for a different audience:

Tactical report (for SOC)

Fresh IOCs, detection rules, immediate actions. Format: IOC list with minimal context, Sigma/YARA rules, blocking instructions. An LLM can generate these reports automatically every time a new campaign is detected.

Operational report (for technical teams)

Campaign analysis, detailed TTPs, hardening recommendations. Format: 5-10 page document with standard sections (executive summary, technical analysis, IOCs, recommendations). An LLM can generate the draft that the analyst reviews and adjusts.

Strategic report (for leadership)

Trends, sector threat landscape, security investment recommendations. Format: 3-5 slide presentation without technical jargon. An LLM can translate technical intelligence into business language.

# CTI report generation with LLM
def generate_cti_report(campaign, audience="tactical"):
    prompts = {
        "tactical": """Generate a tactical CTI report. Include:
            - IOCs (table with type, value, description)
            - Sigma detection rules
            - Immediate blocking actions
            Audience: SOC Tier 1/Tier 2 analysts. Maximum 2 pages.""",

        "operational": """Generate an operational CTI report. Include:
            - Executive summary (3 paragraphs)
            - Attack chain analysis (kill chain)
            - TTPs mapped to MITRE ATT&CK
            - IOCs with infrastructure context
            - Hardening recommendations
            Audience: security team. 5-10 pages.""",

        "strategic": """Generate a strategic CTI report. Include:
            - Potential business impact (no technical jargon)
            - Geopolitical context of the actor
            - Sector trends
            - Investment recommendations
            Audience: CISO and leadership. Maximum 3 pages, business language."""
    }

    return llm.generate(
        system_prompt=prompts[audience],
        campaign_data=campaign.to_context()
    )

CTI platforms and tools with AI

TIP (Threat Intelligence Platform) platforms

• MISP: open source, the de facto standard for sharing intelligence. Extensible with AI modules. Free but requires administration.
• OpenCTI: open source, focused on knowledge graphs. Native integration with MITRE ATT&CK. Excellent relationship visualization.
• Recorded Future: the most complete commercially. Integrated AI for correlation and prioritization. Starting at 10K USD/year.
• ThreatConnect: good SOAR integration. Oriented toward teams needing both CTI and response.

Open source tools with AI

• TheHive + Cortex: incident response platform with automated analyzers (VirusTotal, Shodan, AbuseIPDB).
• Yeti: lightweight CTI platform with REST API. Good for small teams.
• IntelOwl: automates data retrieval from multiple sources for an IOC. 100+ integrated analyzers.
• CAPE Sandbox: open source malware sandbox with behavioral analysis.

Ejercicio practico

Puntos clave