Autonomous Threat Intelligence Platform · Hacking Project

Deliver an automated pipeline that collects, enriches, correlates, and operationalizes threat intelligence with confidence scoring and ATT&CK context.

**The problem**
Threat intel teams manually stitch together feeds, OSINT, and internal telemetry, producing IOCs that are stale by the time they reach detection tooling. Without automated collection, enrichment, correlation, and confidence scoring, intel is noisy and hard to operationalize. Organizations need a platform that turns raw indicators into contextual, ATT&CK-mapped, actionable intelligence.

**What you'll build**
Build a Threat Intelligence Platform that autonomously ingests STIX/TAXII feeds and OSINT, deduplicates and enriches indicators (WHOIS, passive DNS, reputation, sandbox verdicts), correlates them into actor/campaign clusters, scores confidence, and pushes curated IOCs to SIEM/EDR via automated playbooks. Layer ATT&CK technique mapping and an analyst workbench for pivoting. The system emphasizes provenance, TLP handling, and feedback-driven scoring.

**Objective** — Deliver an automated pipeline that collects, enriches, correlates, and operationalizes threat intelligence with confidence scoring and ATT&CK context.

**Expected outcome** — A running TIP that ingests multiple feeds, produces enriched STIX-formatted, ATT&CK-mapped intel objects, and auto-distributes vetted IOCs to a detection stack with an analyst dashboard.

**Difficulty** — Advanced — requires data engineering, entity resolution, feed normalization, and integration breadth.

**Primary category** — Cyber Threat Intelligence (CTI); Secondary = SOC Automation, Detection Engineering, OSINT

**Security domains** — Primary = Threat Intelligence; Secondary = Blue Team, Incident Response, Security Research, DevSecOps

**Technical focus** — STIX/TAXII ingestion, IOC enrichment, entity resolution & correlation, actor/campaign clustering, confidence scoring, ATT&CK mapping, OSINT collection, feed deduplication/normalization, SOAR playbook automation, TLP/provenance governance

**Core technologies** — Languages: Python, SQL, some Go; Frameworks/Libraries: STIX2/TAXII2 libs, MISP API, OpenCTI, pandas, spaCy/NLP; Security Tools: MISP, OpenCTI, VirusTotal/urlscan APIs, YARA, TheHive/Cortex; Cloud/Infra: Docker/Kubernetes, message queues, cron/Airflow; AI/Data: NLP for report extraction, clustering/embeddings, graph analytics; Databases: Neo4j (graph), Elasticsearch, PostgreSQL

**Where it's valued** — MSSPs, financial services ISACs, government/CERT, large enterprise SOCs, threat-intel vendors

**Careers it builds toward** — Threat Intelligence Analyst, CTI Engineer, Threat Hunter, SOC Automation Engineer, Intelligence Platform Developer

**Framework alignment**
• MITRE ATT&CK: Used as the enrichment/mapping backbone — indicators and reports mapped to techniques across the matrix; also models adversary Reconnaissance (T1595, T1598) and Resource Development for tracking
• NIST CSF 2.0: Identify (threat landscape) and Detect (IOC operationalization); supports Respond and Govern (intel-driven risk decisions)
• OWASP: N/A for core platform; API Security Top 10 applies to the platform's own integration endpoints
• CIS Controls v8: 13 (Network Monitoring & Defense), 17 (Incident Response Management), 8 (Audit Log Management)

**Innovation** — Improved Existing Solution / Startup Potential — TIPs exist (MISP, OpenCTI), but autonomous enrichment with confidence scoring and NLP report extraction is a viable differentiated product. Scores: Innovation 7/10, Startup 8/10, Enterprise-Readiness 7/10, Patent = Possible.