DocIntel: A Context-Centric Threat Intelligence Platform

The talk starts from a common problem in cyber threat intelligence: teams must absorb and produce information quickly, yet many threat intelligence platforms concentrate on technical indicators rather than context. Reports end up spread across paid vendor portals, PDF folders on individual analysts' desktops, and blogs that can disappear. Knowledge is lost when subject matter experts leave, and searching across all of these sources is slow, especially when adversaries keep changing how they write up observables.

The speaker introduces DocIntel, a web application that acts as a central, searchable repository for threat reports. Users read documents in the browser, search with filters, and organize material with tags grouped into facets such as geography, software and source. Reports arrive by upload or automated collection, and the tool pre-processes them by extracting metadata, tags and observables using keywords and regular expressions. An analyst then reviews the result, corrects titles and classifications, and the system learns which extracted URLs to ignore over time. Access is controlled through groups, with multi-factor authentication, LDAP integration and audit logs of who viewed which document.

The tool is written in .NET, runs under Docker, and is open source, with commercial support offered on request. The speaker says it scales to hundreds of thousands of documents with some tuning, and mentions a planned Python API client and documentation still in progress. He also invited feed providers to help build connectors. In the Q&A, binary file storage was noted as not yet supported. The main takeaway is to keep threat knowledge centralized and contextual instead of relying on folders and indicator lists.