Introducing EclecticIQ Threat Scout

In the realm of cybersecurity, CTI is invaluable, offering insights into the tactics, techniques, and procedures (TTPs) of cyber adversaries. These insights are crucial for developing robust and resilient cyber defenses in the face of increasingly sophisticated threats. However, much of the CTI available online is in unstructured formats—ranging from threat reports and social media posts to news articles and hacker forums. This presents a significant challenge for security teams in efficiently aggregating, analyzing, and disseminating CTI.

According to a 2022 SANS report, over two-thirds of respondents are still performing manual data processing to render CTI usable. This process is both time-consuming and resource-intensive. Automated processing, particularly for online content, often relies on traditional web crawlers, which are difficult to implement and maintain due to the dynamic nature of online content. Furthermore, threat reports frequently contain irrelevant information, complicating the extraction of critical details pertaining to attack behaviors. The need for sophisticated, automated solutions to filter out irrelevant data and focus on pertinent information is more pressing than ever.

Advancements in Artificial Intelligence (AI), particularly in Natural Language Processing (NLP) technologies based on the latest machine learning models, offer a new way forward. These technologies can identify complex patterns, relationships, and entities within text with remarkable accuracy. By leveraging OpenAI's cutting-edge NLP technology, our threat intelligence experts have crafted precise prompts that enable the accurate extraction of entities from unstructured text.

While there are other solutions that utilize NLP for CTI extraction, many are merely add-ons to existing CTI platforms or are hindered by access restrictions and licensing fees. This lack of accessibility can prevent defenders from timely action against threats, giving attackers an undue advantage. EclecticIQ Threat Scout democratizes access to advanced NLP technology for comprehensive threat data extraction, without restrictions.

Threat Scout allows users to scan online text-based documents in their browser with a single click. It utilizes advanced regex patterns to extract tactical Cyber Observables, such as IP addresses, hashes, and domains. With an OpenAI API key, it also identifies high-level Entities, including Attack Patterns, Malware, and Threat Actors. This enables the generation of STIX 2.1 compliant intelligence in moments, streamlining the analysis and data processing tasks while safeguarding data privacy through the OpenAI API.

The extension's built-in editor offers analysts unprecedented control over AI-extracted data. Identified data is prominently displayed, allowing analysts to easily verify information, correct entity types, and minimize data noise. Furthermore, analysts can select and group extracted data for specific applications, such as compiling Indicators of Compromise (IOCs) for SIEM integration.

Integration with EclecticIQ Intelligence Center enhances data categorization and labeling, facilitating seamless inclusion into automated workflows for immediate analysis or distribution.