Gita Ziabari -Yalda: Automated Bulk Intelligence

### The Alert Fatigue Crisis in Modern Security Operations At 00:00, Gita Ziabari opens by diagnosing the fundamental challenge plaguing modern Security Operations Centers (SOCs): overwhelming alert fatigue. Every day, enterprise monitoring systems and automated endpoint telemetry generate tens of thousands of alerts, suspicious file hashes, outbound IP connections, and domain requests. SOC analysts spend disproportionate amounts of time manually pivoting between separate open-source intelligence (OSINT) portals to research indicators of compromise (IOCs), resulting in delayed incident triage and missed intrusions.

### Introducing Yalda: Automated Bulk Threat Intelligence At 04:30 and 08:45, Ziabari introduces Yalda, an open-source bulk intelligence gathering framework designed to automate the initial stages of artifact triage. Rather than requiring analysts to copy and paste individual indicators into multiple web interfaces, Yalda ingests large batches of suspicious artifacts—including IP addresses, URLs, domains, and MD5/SHA-256 hashes—and simultaneously queries multiple threat intelligence repositories through an asynchronous backend engine.

### Aggregating Intelligence Across Diverse Threat Feeds At 13:40, the presentation explores Yalda's modular API connectors. The framework consolidates data from premier external intelligence sources, including VirusTotal, AlienVault Open Threat Exchange (OTX), Shodan, PassiveTotal, and WHOIS databases. Ziabari explains how Yalda parses raw JSON API responses, normalizing divergent vendor classifications and threat scores into a structured, unified analytical schema.

### Contextual Enrichment and Signal-to-Noise Reduction At 18:20 and 22:15, Ziabari demonstrates how Yalda extracts actionable context to separate high-priority signals from background noise. Beyond reporting simple detection ratios, the tool enriches indicators with passive DNS historical resolutions, SSL certificate issuer data, autonomous system numbers (ASNs), and registrar reputation. This contextual enrichment enables analysts to instantly distinguish between commoditized adware beacons and targeted command-and-control infrastructure associated with advanced threat actors.

### Workflow Integration and Enterprise Customization Concluding between 24:10 and 25:46, Ziabari explains how Yalda integrates into existing enterprise incident response workflows. The framework supports configurable API throttling, custom whitelist filtering, and programmatic export to SIEM platforms and ticketing systems. She encourages organizations to adopt automated bulk triage tools to empower human analysts to focus on complex investigation and proactive threat hunting.

(AI summary — Gemini 3.8 Flash)