CTI Agent Automated Battlecards from CTI Reports

CTI Agent: Automated Battle Cards from Cyber Threat Intelligence Reports

Mohammad Nabil, a cybersecurity veteran and PhD in cyber, presented "CTI Agent," an agentic system designed to automate the collection and synthesis of cyber threat intelligence (CTI) from threat reports using Large Language Model (LLM) agents. The system aims to generate structured threat actor battle cards from unstructured, natural language threat reports, which often contain multiple modalities, conflicting or incomplete information, and implicitly stated Tactics, Techniques, and Procedures (TTPs).

The CTI Agent Process

The system operates in four main steps:

Collection: Gather a comprehensive set of threat reports from trusted sources like security vendors, investigative journalists, and reputable GitHub repositories and Twitter accounts. High-quality data is crucial to avoid noise.

Clustering: Group the collected reports by threat actor using unsupervised learning. Two strategies were explored: document embedding and clustering, and LLM-generated summary embedding followed by clustering. The summary embedding approach consistently outperformed document embedding in terms of cluster quality (silhouette scores).

Battle Card Generation: Utilize LLM agents to extract structured battle card information from the grouped threat reports. This involves using agentic systems with tools for report collection, searching for missing information, and extracting key artifacts.

IOC Update: Automatically update battle cards with new and up-to-date Indicators of Compromise (IOCs) by leveraging techniques like graph expansion, which identifies associations between IOCs through infrastructure reuse and rotation by threat actors.

LLM Agents and Battle Card Extraction

The system employs agentic LLM solutions, which offer advantages over simpler prompting or retrieval-augmented generation (RAG) by having access to more data, tools, and optional memory. The "ReAct" (Reasoning and Acting) pattern is used, where agents interact with tools to gather information, update their environment, and iteratively refine their understanding until a final answer is reached.

For battle card extraction, a MapReduce-like approach is used. Individual reports are processed by separate agents to generate initial battle cards, which are then synthesized by another LLM into a single, comprehensive battle card. This method overcomes limitations of processing large amounts of data at once.

The generated battle cards are structured and programmatically consumable, including:

Threat actor summary and aliases

Campaign details (start/end dates, targeted industries)

IOCs and TTPs

Tools and malware binaries used

Exploited CVEs

Sources of information

Graph Expansion for IOC Enrichment

To address the outdated nature of IOCs in published reports, a graph expansion technique is employed. This involves:

Taking known IOCs from battle cards.

Building a network of associated IOCs (domains, IPs, certificates, etc.) based on shared infrastructure and reuse patterns.

Enriching this network with properties and performing graph embeddings and clustering.

Attributing newly identified malicious IOCs within clusters to specific threat actors based on known threat actor domain associations.

Updating the battle cards with these newly discovered IOCs.

Future Work and Conclusion

Future work includes incorporating multi-modal information (images, charts) into the battle card generation process and further reducing human involvement by enriching validation data, potentially by integrating with frameworks like MITRE ATT&CK.

The CTI Agent system demonstrates a robust method for automating the creation and maintenance of threat actor battle cards, enhancing proactive detection and intelligence consumption within cybersecurity operations.