MISP ↔️ LLM : Automating Free Form CTI Reports

Cyber threat intelligence analysts often have to read large numbers of free-form reports, such as blog posts and articles, and pull out indicators of compromise, TTPs, threat actor details and other context. Doing this by hand means copying text into MISP piece by piece. The talk proposes a faster route: a MISP module that submits a report URL to a REST API server, which asks a language model to extract the structured information and return it to MISP. The model can be swapped, so a local or hosted LLM both fit the design.

In the live demo, the presenters added a report to a MISP event and trimmed it manually, removing boilerplate at the start and appendices at the end so the model handled it better. After submission, the event received an executive summary and labels drawn from the output, such as an espionage motivation and an associated threat actor. The presenters stressed that the extraction is still very basic and that the prompts need considerable work.

The main takeaway is that model output must be checked by a human before it is trusted, since the answers may be incorrect. Review is part of the design rather than an optional step. The team plans further work on prompt tuning and quality assurance, and the project is an early proof of concept rather than a finished tool.