You Just Got A CTI Program Funded. Now What?

The speaker, a technical product manager at a Lithuanian managed security provider, explains what happened after their cyber threat intelligence program received EU co-financing. When work began, the SOC had a small team, a MISP instance fed by little useful intelligence, and no real intelligence cycle. Regional geopolitical pressure and a wave of attacks on crowdfunding supporters made the need clear.

The team measured its starting maturity with the SOC-CMM model, reviewed intelligence requirements against a commercial handbook, and automated ticket creation from existing incident, OSINT and hunting workflows. They also tried to launch a sharing community early, which drew no takers because many local organisations lacked a sharing platform. Several missteps are highlighted: focusing on requirements and sharing before internal data was solid, building the process inside Jira, which became far more expensive after pricing changes, and fragile automation. Narrowing feeds to a few trusted sources cut alert volume sharply, and about 200 hand-verified events were eventually shared.

The main takeaways are to start with one data source, use free resources such as FIRST feeds and public vendor blog feeds, define actions before requirements, and secure lab infrastructure early. Success is measured through SOC metrics such as reduced triage time and fewer false positives, reviewed quarterly against the maturity model.