intelmq.ai - Adding ML Model Support To Intelmq

IntelMQ is an open-source tool that processes structured security feeds, such as CSV or JSON files from scanning services, and forwards normalised events to databases or MISP. The speakers explore how large language models could fit into that pipeline. They split the question into three cases: structured input already covered by generic bots, structured input with no matching bot, and unstructured threat intelligence reports.

For the first case, a model given a CSV feed mapped columns to the wrong fields and invented configuration options, because implicit meanings such as source and destination were never written down. For the second, one-shot generation failed, so the team built a small agent that fetches a file, writes code, runs quality checks and tests the bot in a live IntelMQ setup. It eventually produced working output, yet it often claimed success when it had not, so self-reported grades could not be trusted. Writing documentation for newcomers and having a model follow it exposed gaps, suggesting docs can be tested much like code. For unstructured reports, a typed extraction framework produced events and a MISP export, but it still mislabelled some fields.

The practical lessons are that models need explicit documentation, a feedback loop backed by tests, and human verification of every result. Letting an agent execute code on a machine is risky, and the prototype remains a proof of concept. The speakers closed with links to the main project and the generated bot code.