DEF CON 33 Recon Village - CTI Agent Automated Battlecards from CTI Reports - Mohamed Nabeel

This video introduces CTI Agent, an agentic system designed to automate the synthesis of cyber threat intelligence reports into structured battle cards 0:55-1:13.

Key Takeaways:
• Existing CTI reports are difficult to process because they are unstructured, contain conflicting data, and often require manual inference of implicit TTPs 1:27-2:14.
• Grouping reports by threat actor is most effective when using LLM-generated summaries for embedding rather than raw document text, resulting in superior cluster separation 6:33-7:30.
• The system utilizes a ReAct agentic pattern with specific tools for report collection, searching, and extracting data via a map-reduce synthesis process that writes code to consolidate findings 12:50-16:10.
• To combat outdated IOCs in published reports, a graph expansion technique identifies new malicious infrastructure by analyzing relationships and clustering known threat actor assets 18:30-20:00.

The presentation concludes by noting the system's ability to proactively detect new threats and outlines future work involving visual data integration 23:22-24:00.

Sources:

• 0:55 Introduction to CTI Agent
• 1:27 Challenges with natural language CTI reports
• 6:33 Summary vs document embedding performance
• 12:50 Agentic system tools and map-reduce logic
• 18:30 Graph expansion for finding new IOCs
• 23:22 Su