Gains:
- Ability to understand that artificial intelligence summarizes long threat reports at three levels (strategic, tactical, technical) and maps them to MITER ATT&CK by extracting IOC and TTP
- Ability to verify each IOC with current and second independent source, each technique in ATT&CK and extract fabricated IOC/technique/group
- Ability to understand that group attribution is the riskiest claim, that the language 'compatible with techniques' should be used instead of 'exact group' and that the defense should be based on a permanent TTP determination.
A security team alone doesn't just fight the attacks it sees; learns by sharing knowledge of attacks around the world. Threat intelligence (TI for short) is information collected, processed and turned into action about attackers, the tools they use, their targets and methods. "Which malware is spreading now?", "Which sector is this attacker group targeting and how does it act?", "Has this IP address been seen in an attack before?" The answers to questions such as these come from threat intelligence.
The problem is that threat intelligence is abundant and dispersed: reports, blogs, feeds, forums, thousands of IOCs. AI is powerful at making sense of this stack: it summarizes long threat reports, extracts structured IOC and TTP from the narrative of an attack, maps them to the MITER ATT&CK framework, and asks “does this concern us?” prepares the first draft of the question. But AI can mistake old, inaccurate, or out-of-context intelligence as true, make up a non-existent threat group or IOC, and not know whether intelligence is truly valid for your organization. AI summarizes, structures and maps intelligence; It is up to the analyst to blocklist an IOC, apply intelligence to the agency, and declare a report “actionable.”
Layers of threat intelligence
Threat intelligence is considered at three levels:
- Technical/operational (IOC level): Concrete indicators — bad IPs, domains, hashes, URLs. It is short-lived (attacker changes IP). AI is quick to extract these from the report and structure them.
- Tactical (TTP level): How the attacker behaves — what techniques, tools, methods he uses. It is more permanent (behavior is difficult to change). MITER ATT&CK is the common language of this level.
- Strategic: Who is targeting, why, which sector, with what tendency. It feeds management decisions. AI summarizes long reports at this level.
Terms: IOC (Indicator of Compromise — indicator of violation, concrete technical trace). TTP (Tactics, Techniques, Procedures — behavioral pattern). MITER ATT&CK, a numbered, documented library of attacker techniques (e.g. T1566 "Phishing"). APT (Advanced Persistent Threat — advanced, persistent, often state-sponsored attacker group). Feed, automatically updated IOC stream. Misattribution, attributing an attack to the wrong group; It is the most common mistake of intelligence.
Intelligence source evaluation chart
criterion
question to ask
Why is it important?
Currentness
When was it published? Is it still valid?
IOCs become obsolete quickly
Source reliability
Who published it, what is its reputation?
Lots of false/fabricated intelligence
Relevance
Does it target us/our industry?
Not every threat is your threat
Verifiability
Does a second source confirm this?
One source is not enough
Actionability
What can I do (block, track, call)
Knowledge must turn into action
Citation accuracy
How solid is group attribution?
Misattribution misleads
three mini cases
Case 1 — From 40-page report to action. An analyst has the AI summarize a 40-page threat report about a new ransomware campaign. AI reduces the report to 1 page, extracts 32 IOC (IP, hash, domain) and 7 MITER ATT&CK techniques, and notes "this group is targeting your industry." The analyst verifies each of the IOCs with a second source, adds the 21 that are still valid to the watch list, confirms the techniques' ATT&CK numbers, and develops it into a threat hunting hypothesis. The AI made 40 pages processable; verification and action were the analyst's.
Case 2 — Made-up APT group. An analyst asked AI "which group carried out this attack?" he asks. AI confidently answers: "This is the known technique of the 'APT-Dark Eagle' group." The analyst looks for this group in known threat intelligence sources — there is no such group, the model made up the name. If he had not confirmed it, the report would have gone out with an incorrect attribution. Lesson: group attribution is the easiest and riskiest claim to make; It is always verified by a known source and is often referred to as "compatible with the following techniques" rather than "exact attribution".
Case 3 — False blocking with old IOC. One team asked the AI "shouldn't we block" a list of IPs it received from a report months ago? he asks; The AI says “yes, they are malicious.” But the analyst sees that one of the IPs now belongs to a legitimate cloud provider (CDN); Blocking that IP would also cut off the legitimate services the organization accesses. IOCs are short-lived. The analyst verifies currentness and eliminates outdated ones. Lesson: It doesn't go on the blocklist until the IOC verifies its currentness.
Weak prompt / Strong prompt
Weak prompt:
Who did this attack and which IPs should I block? [report]
This request asks for precise attribution and direct blocking decision from the AI, it does not ask for timeliness and verification, it is open to fabrication. AI may give a convincing but inaccurate attribution and outdated IOC list.
Powerful prompt:
Your role: assistant to the analyst preparing threat intelligence SUMMARY and CONFIGURATION. Decision making; Don't say "block", don't make specific group references. Process the following report:(1) extract 1-page summary (who, what, target, method),(2) structured list of IOCs (IP, domain, hash, URL); mark "[currentness and secondary source must be verified]" for each; add dummy IOC,(3) map TTPs to MITER ATT&CK but mark each T-number "[confirm in ATT&CK]",(4) do not say "exact group" for attribution; Use the language "compatible with these techniques" and state the strength of evidence, (5) write questions as to why this intelligence might apply to our industry/architecture. Report: [paste]
Strong claim asks for summary + structure, leaves each IOC/TTP to verification, prohibits precise attribution, questions relevance.
Copiable prompt templates
REPORT SUMMARY TEMPLATESummarize the following threat report at 3 levels: (1) strategic (who, why, target sector), (2) tactical (TTPs used), (3) technical (types of IOCs).Do not exceed 1 page. Do not include any claims that you have not removed from the report; fabrication.Report: [paste]
IOC EXTRACTION TEMPLATEExtracts structured IOCs from the following text: type (IP/domain/hash/URL/email),value, context. Take only what is CLEARLY stated in the text; fitting. Check "[current + secondary source must be verified]" for each IOC. Verify in tabular form.Text: [paste]
ATT&CK MATCHING TEMPLATEMap the behaviors in the attack narrative to MITER ATT&CK tactics and techniques. For each mapping: behavior quote + suggested technique name +"[T-number must be confirmed in ATT&CK]". Don't give a made-up technique/number; if you're not sure, write "[unclear]". Narration: [paste]
RELEVANCE ASSESSMENT TEMPLATEHelp me evaluate whether the following threat intelligence is applicable to our organization: generate the questions which of our assets match the target technology/industry. Decision making; Give me a checklist. Intelligence summary: [paste]
Common mistakes
- Making precise group attribution. Attribution is the most difficult and most misunderstood area; Instead of "exactly that group", say "compatible with these techniques" and confirm with the source.
- Blocking the IOC without verifying currency. IOCs are short-lived; An old IP may now belong to a legitimate service, check for freshness first.
- Trusting a single source. Confirm intelligence with a second independent source; There is a lot of false/fabricated intelligence.
- Not questioning relevance. Not every threat is your threat; Look at industry, technology and architecture overlap.
- Making up the IOC/technique/group thinking it is true. AI can adapt them fluently; verify each at known source and MITER ATT&CK.
Tip: The most persistent and valuable layer of threat intelligence is the TTP, not the IOC. The attacker changes his IP in one day, but it is difficult to change his behavior pattern (TTP). Build your defense on TTP detection, not IOC blocking.
Caution: Putting an IOC on the blocklist may also intercept legitimate traffic (false positive blocking). Pointing the finger at a group incorrectly wastes resources in the wrong direction. Intelligence is an input; The blocking and attribution decision rests with the analyst after verification.
In summary
Threat intelligence enables the organization to fight not alone but with the experience of the world; but because it is numerous, messy, and variable, it requires interpretation. AI summarizes long reports at three levels (strategic, tactical, technical), extracts IOC and TTP, maps to MITER ATT&CK and provides relevance outline. Biggest risks: made-up IOC/technique/group, accurate but false attribution, and obsolete IOC. That is why every IOC is validated with currentness and second source, every technique is verified in ATT&CK; the reference is made in the language "compatible with techniques" and not "definitive group"; and the decision to block/enforce is the analyst's. The heart of the defense is permanent TTP detection, not short-lived IOCs.
Application task
Get a public sample threat report. Extract a summary and structured list of IOCs from AI with the “Report Summarization” and “IOC Extraction” templates. Check the currency and authenticity of 5 of the IOCs on a known source; Try to find at least one outdated or questionable IOC. Verify the T-numbers of the techniques released with the "ATT&CK Matching" template on the MITER ATT&CK site and catch a fake/false number if any.
checklist
- [ ] I summarized the report at three levels (strategic, tactical, technical).
- [ ] I have verified each IOC with currency and a second independent source.
- [ ] I have verified each MITER ATT&CK technique/trick in the official source.
- [ ] I have addressed the group reference in the language of "consistent with techniques" rather than "exact".
- [ ] I questioned the relevance of intelligence for my institution (sector, technology, architecture).
- [ ] I have fact-checked each claim, knowing it may be made up IOC/technique/group.
- [ ] I made the decision to block and implement as an analyst after verification.