But mostly worked in the finance space, in the tech space, and then prior to that I was in geopolitical risk. So that's enough about me. Let's talk about housekeeping. This session is being recorded, and yes, you will be sent the recording along with a whole bunch of resources, including the slides

from Steve. So no need to stress about taking copious notes. We do have everything recorded. If you see me glance to my left, I've got a second screen, still very much engaged, just want to make sure I cover off all of my notes.

Other things to note, this session's CTI sessions are now applicable for CPE certificates of attendance. The only catch is you have to join live and you have to join for at least 50 minutes to be eligible. So we track this using Zoom and everyone who stays for over 50 minutes will be sent a CPE certificate of attendance to then submit to your certification body. That will be done within 48 hours after the end of the session

So keep an eye out for that email from myself. It will land in your inbox in due time. Now we do encourage lots of questions throughout the entire session. We aim to make about five minutes towards the end of the session to ask questions, but I always like to leave them into the whole session, so it's nice and interactive

In order to ask questions, use the Q&A box. Do not use the chat function, we have disabled that, but we will be answering your questions live throughout the session, and I'll be interrupting Steve very rudely during his presentation to pop questions to him. However, if we hit the end of the session and we have a backlog of questions

Don't worry, they will still be answered. We compile them into a Notion page. Steve will be shared that Notion page. He'll type in his answers, and then we share that along with the webinar recording to everyone who registered for this session.

Right, that is the housekeeping and my introduction. Now I'm going to jump through a couple of slides to set the scene, and then I'll pass it over to Steve.

I would be remiss if I did not talk about Feely for a couple of minutes. And what I'm going to do is run through this slide very quickly, just to give you a high level overview of what Feedly is, since we're the ones hosting the webinar. But for those of you who actually want to see the platform and understand it, I will be doing an optional five minute demo at the end of the session. So this will be at the top of the hour. It doesn't need to enter any time that we have with Steve. And this will be optional for anyone to stay on and attend afterwards if you're curious to see what Feedly is. And I'll walk you through a timed five minute demo

Focused on how to uncover fraud using Feedly. But for those of you who just want a quick 2-minute overview right now, Feedly is an AI platform that CTI analysts use to collect information and action it as quickly as possible

We bring in information from around 10,000 plus trusted cybersecurity sources. They get brought into our platform, and we structure all of that content using different AI models. We tag different entities, and they all get added to our real time threat graph.

This thread graph tags all the relationships between these different entities relevant to the cyber threat landscape. Then we make that threat graph accessible using different features powered by AI. So we've got things like AI features and Intel agents that help you filter for relevant content based on your intel requirements. And then we also help you with the production stage of the Intel cycle with features like the automated newsletter and the report builder, and we also want to help with dissemination and automation. So we do have various API-based integrations, no code integrations, and an MCP

If you want to see what the platform looks like, hang around towards the end of the session.

That's enough about Feedly, let's talk about our agenda. So, the next slide, we will pass over to Steve to introduce himself, and then I'll be handing over for most of our time to Steve, who's going to give us a fantastic presentation all about the relationship between CTI and fraud.

As mentioned, there will be that Q&A portion towards the end, and the optional Feedly demo to wrap us up once we hit the top of the hour.

Now, I've been mentioning Steve quite a lot, so let me do more of a proper introduction. We've got Steve Diamond here from the Retail and hospitality ISAC. Now, I could talk about Steve, but it's better to hear about him from himself. So Steve, I'll pass it over to you. Who are you?

Thanks, Josh. I appreciate it. So like the slide says there, I'm Steve Diamond, senior cyber threat intelligence analyst at the retail and Hospitality ISAC, where I focus on a host of different things, OSINT, fraud, fraud intelligence, dark web cybercrime, you name it

Weird background compared to a lot of people in this space. I'm an intelligence professional by trade, government, military, and through the years I've ended up in cyber, ended up doing a lot of research within the cyber crime world

It just kind of started moving my way up through retail and now I'm here helping out our membership. You know, giving investigative assistants, advisement, all that kind of cool stuff for our member companies. So yeah, it's a little bit about me

Perfect. Thank you very much, Steve. Now we have a tradition here on CTI sessions. It is an icebreaker game called Finish the Sentence. I start a sentence, you finish the sentence. Now, for the audience, Steve has not seen these before, so this is going to be an organic, knee-jerk reaction and he could make a complete fool of himself.

So the first one is the best vacation I took recently was

Oh, I'd have to say Hawaii. I mean, it was maybe a couple years. It was maybe like two years ago, two, three years ago now, but out of all the vacations I've been on recently, that's just the best. I used to live there. I was stationed there for three years

And yeah, it's just it holds a special place in my heart.

Oh, lovely. I've not yet been. What's your favorite thing about Hawaii?

I mean, obviously the beaches, but the food, too. I'm a… I'm a sucker for plate lunches in Hawaii.

Okay, great answer. Okay, number 2. My favorite AI use case is

I would say helping me with my wardrobe, which is actually really funny considering I live in cyber. I am a terrible dresser and I do not know how to shop. So ChatGPT's really been helping me out in that regard.

Wow, I did not see that answer come in at all. That's a good one

At least it's, it's, yeah, I mean, I can't

Yeah, I'm like, I'm trying to picture using ChatGPT for that output. That's a really, really good one. Okay, the third one

The best piece of advice I was given during my career has been

Don't be afraid to fail and don't be afraid to ask what you think is a stupid question, right? We learn through our failures. And, you know, we always have this notion that

A question that we have might already be known by other people or by the masses, and we're the odd person out when in reality, those kind of questions are something that a lot of people want to ask, but are just kind of afraid to. So yeah, I mean

Failure is something to learn from, and if you're curious about something, always ask.

Yeah, I appreciate that. I think people who ask stupid questions in meetings, especially, or public forums, they tend to be the most secure people, or they give off that air of security, so I do always encourage people to do it, because you're right that everyone will have that question, but only a few people have the guts to ask it.

I've got one for the audience. So in order for us to tailor the conversation to what is most relevant to the highest number of people attending live. We have an audience poll question for you. The question is, what type of fraud is your top priority right now? And to answer this, we're going to have a pop up that will appear right in front of you

And click whichever answer makes most sense for you. And then the possible answers are account takeover, refund or return policy abuse, loyalty points and gift card fraud, payment fraud, brand impersonation, which does include phishing and scam ads

So if you chuck your responses into the poll, we will be showing those results live. Quick check. Gabby, Steve, can you see the the polls quiz pop up I've got?

Yeah, the poll is, oh, I'm getting some responses already.

Okay, I've dragged the window over to my screen share. Can you see it?

Okay, no worries at all. What I'll do is I'll stop screen sharing to give you Steve a chance to share your slides. But whilst you're doing that, I'll speak to the results. So, so far we've had 71 people vote

And in top place, Steve, we've got brand impersonation. So this is including phishing and scam ads. Second place, we've got account takeover at 22%. And then third place is bots and automated abuse. So thank you everyone who participated in that poll. Really interesting to gather those results, and it does help us tailor our conversation to the types of fraud that are top priority for you

With that, I'm going to pass over to Steve. Steve, the mic is yours.

All right, awesome! So, first and foremost.

I want to thank everybody for joining today. This is really cool being able to do this with Feedly and very, very happy that they brought this opportunity to me. Also, a shout out to some people that I see in the session right now. Some of my friends

are in the retail and hospitality world, so don't think I didn't see you. But yeah, so today we're going to be talking about using threat intel to uncover fraud.

In kind of different ways that, you know, you really take that external piece and bring it back to what is traditionally been kind of an internal program and internal investigative thing.

In my opinion, right, fraud's an intelligence problem. You know, traditionally, whenever we've looked at fraud in the past, especially within a singular organization, right? You're looking at internal and vendor data first and foremost. That's kind of your main point of

Of your intelligence, right? You're looking through a treasure trove of data, you know, with your data science team or using SQL or what have you, right? And you're trying to find these patterns. You're trying to find out

What's an anomaly amongst all the noise, you know, within your organization? You know, are there, if you're a retail organization, are you seeing a lot of, you know, refunds being processed? Are you seeing a weird amount of

items being ordered in a certain geographical area, right? You know, as a vendor providing a bunch of stuff to you, right? And, you know, you're taking all of this information, you're doing your analysis, you're finding out things, right? And you're

And you're reporting them up, you know, your chain of command, whether it be to your team, whether it be to a separate team who handles mitigation or, you know, discovery, that sort of thing, right? And then you're going to be putting in your mitigation and your monitoring

Right? So you're plugging up those holes that you found through your investigation and through your analysis, and then you're going to be monitoring those to make sure that they're all in place, everything is everything is good, everything is kosher, right? And you're just going to keep repeating that process over and over

Where I see a gap is right here in between your internal vendor data and your analysis, right? To me, there's something missing, right? And what is that? Well

You can have all of this data inside of your environment, right? But what you're not seeing, you're not seeing the actors, the specific actors who are doing this kind of fraud and who are advertising this kind of fraud.

You're not seeing what type… what type of fraud they're committing. Are they advertising refund services? Are they… are they advertising stolen credentials? Are they advertising the use of stolen payment methods, right? You're missing their tactics, right? How exactly they're performing these things, how exactly they're performing this fraud

And you're not necessarily seeing the full scale of the fraud, right? You can see what it is within your own environment, but you're not really sure how widespread that specific campaign, that specific actor, right? Not really sure what that really looks like in the grand scheme of things

And fraud's one of those things where it doesn't respect your organizational boundaries, right? Just because you have a fraud team doesn't mean that that's the only place that fraud affects. It's the only place where fraud happens, right? Fraud is seen by almost every area of your business, right? I have some examples here

You know, of course your internal fraud teams are seeing the larger data sets, right? They're seeing the patterns. But

You're looking at, you know, a department like marketing, right? What's marketing in charge of? They're in charge of crafting campaigns to promote your business to consumers, right? To drive people in. Well

What marketing isn't seeing are the various uses of brand abuse that these threat actors are doing, right? Using these campaigns against consumers, you know, taking your branding, taking your logo and duping consumers into providing PII payment information

Maybe sending them malware, right? Tons of different ways. You know, PR

PR was a great department that I've worked with in the past, simply because they're the ones who are going to address any backlash. Your company may need to release something that's a scam that's impersonating your organization and you have a large negative customer sentiment. You might need PR to fix that

And then you see finance, who's discovering all the losses from potential fraud, right? If it's fraud that's actually affecting your organization, right? People doing policy abuse, these sorts of things, right? Finance is going to see that you're losing money. You're hemorrhaging money in one area, and they're going to want to know where that money's going and how to stop it.

And last, but certainly not least, your customer service teams, customer service, customer operations. They're on the front lines of a lot of things

and forging a relationship with them is absolutely crucial, especially whenever you work in an environment such as retail and hospitality, where these people are interacting with the customers directly, and more times than not, they're interacting with the fraudsters directly. The fraudsters are conducting social engineering against them

They're convincing them that their issue that they're raising is legitimate, even though it's completely false and it's completely fraudulent, right?

And that just leaves a lot of vulnerability there, right? The human vulnerability within fraud is massive, and it's something that we really need to take seriously because there's no policy that can stop that, right? There's no rule we can put in place to stop that, right?

It's all about understanding what the fraudsters are doing and making sure that you can train those individuals to detect that.

How do you interact and train up customer service when customer service is a AI chatbot as opposed to a human?

That is a very, very interesting question. What I would say

I haven't dealt with this personally whenever I was at my previous retailer and did a lot of these things. It was all human-based

So we actually had people talking, but one thing that I can

you know, say is have detections in place for, you know.

Anything that you can deem as, you know, let's say repeated, right? Or anything that's kind of within a scope that you determine. So, for example, if your customers are interacting with an AI chat bot and they're saying, hey, you know, I didn't receive my order because

You know, I didn't receive my order. It says delivered but not received, right?

You can use that as a flag. You know, hey, if the chat sees this alert whoever, right, for some more investigation. Or if you start seeing, you know.

erroneous claims, right? I need this… I need this item because it's my daughter's birth… it's my daughter's seventh birthday, and she's gonna freak out if she doesn't have this brand new 100-inch TV by tomorrow, right? So just some ways that you can kind of

Look at what your current chats look like, right? And then kind of make some detections off of that.

So knowing all of these things, right, and uncovering this problem

Obviously, you're going to need to build something, build a program, build a capability, right? To kind of put all these pieces together and kind of bring this together. So

a little bit about me. Before I came to the RHISEC, I worked for a large international, fashion retailer, whose name… I'll leave the name out of it for right now. But essentially

My colleagues and I were hired on to start a cyber threat intelligence program. My manager at the time and I were the only ones who had, you know, traditional CTI experience and CTI exposure. So we were really brainstorming on what this program could become

he had this great idea, shout out Jake, to bring fraud into the mix and intelligence collection. And, you know, use the expertise that I've developed within cybercrime, within dark web investigations

To really see it from an intelligence standpoint of what we can do against these fraud actors who are hitting us, right?

Threat Intelligence is often associated with cybersecurity, but its potential extends far beyond the SOC. From identifying organized fraud schemes and understanding criminal tactics to supporting investigations and informing fraud prevention strategies, intelligence can play a critical role in protecting organizations from financial and operational threats.

In this session, we’ll explore how organizations can leverage internal data, OSINT, and threat intelligence to uncover fraud, understand the criminal ecosystems enabling it, and turn intelligence into meaningful action. Through real-world examples and lessons learned, we’ll discuss how to build effective fraud intelligence capabilities, collaborate across business functions, and leverage trusted communities to identify emerging fraud trends and combat threats at scale.

Uncover fraud through intelligence: Leverage internal data, OSINT, and threat intelligence to identify emerging fraud schemes, investigate criminal activity, and understand the Fraud-as-a-Service model.

Turn intelligence into action: Collaborate across fraud, cybersecurity, and business teams to support investigations, strengthen fraud prevention, and uncover gaps in the overall fraud picture.

Combat fraud through collective intelligence: Share intelligence through trusted communities like the RH-ISAC to identify common threats, uncover broader fraud trends, and strengthen industry-wide defenses.

Feedly is the AI platform CTI teams use to track threats, contextualize what matters, and deliver tailored intel in minutes.

Feedly Threat Intelligence

Certificates of attendance for this session were sent to attendees on Friday, October 30th, from cti-sessions@feedly.com

If you did not receive the certificate of attendance, please check your junk email inbox. If it is not there, email cti-sessions@feedly.com and we will look into it.

 I have some very smart friends across the industry whom I credit all of my knowledge to!

 I’ve used various threat intelligence providers in the past with varying degrees of success. With that being said, I maintain my own research environment so I can collect and investigate firsthand.

You can use RSS feeds however, I do use an intelligence vendor as a tip-off point. I also maintain my own research environment so I can discover, collect, and investigate intelligence firsthand.

Steve Diamond

Sr Cyber Threat Intelligence Analyst at the Retail & Hospitality ISAC

Learn how to turn threat intelligence and OSINT into business impact, from fraud detection to investigations and industry-wide defense.

Beyond the SOC: Using threat intelligence to uncover fraud

Feel free to ask questions at any point. I'll be keeping an eye on the Q&A. We also have Gabby from the Feedly marketing team, who will also be here to support in the background and keep an eye on those questions as well. And I'll be rudely interrupting Renzi with questions throughout the entire webinar, so don't feel like you have to wait until right at the

We are going to make this more of a more question is peppered throughout the entire session.

So now, I'm going to run through a couple slides just to, like, kick us off, and then we'll dive into things in more detail. So, firstly, I want to first give some context about Feedly. For those of you who are slightly newer to the platform and kind of wondering what we do, I would hope for about 2 minutes now, and then at the end of this session, we are going to be doing something new

Based on feedback and demand that we've had from people attending these sessions, we are now going to be adding in an optional five minute feed demo at the end of the session. So this week right at the top of the hour. For anyone who's interested in seeing the platform and kind of learning a bit more about it, because a slide can only teach you so much

So if you're keen to learn about Feedly, feel free to hang around after this session and I will run through a very quick five minute demo. But just for those of you right now, Feeli is a platform that helps you track different threats, primary drawing sources from the open web, but we are starting to branch out more into the deep and dark web

The whole idea here is to utilize AI to help CTI analysts operate faster. And we do this following this four-stage process you see on the slide in front of you. We take all of these open web sources and dark web sources. We apply some AI processing to structure that content and to tag different threat intelligence entities

We then have all of that added to a real time threat graph where we're mapping the relationships between threat actors and CVEs, malware families, TTPs, so on and so forth. And then we enable you to access and query that threat graph using different features in the platform, such as Intel agents

AI feeds and our ask AI research tool. This essentially enables you to track the different threats that are relevant to you and to build responses using AI tools that are highly curated to your specific context. And then would you like to help with the later stages of the Intel cycle? So we've got some features like the report builder and automated newsletters

To help, further automate and speed up the process of intelligence production and dissemination.

I'm going to stop talking about Feely right now, because I want us to move swiftly into the actual meat of the presentation itself. That is a very quick two minute discussion, and we will dive into more during the demo at the end of

So how are we going to tackle this huge topic of CTI of AI Skills for CTI? Here is the agenda. We're going to focus on the context behind skills, how you can create AI skills for CTI and then how you can deploy agents to further support that

And then there are going to be some free resources that Renzi is going to point us to. And I should mention that a lot of what you're going to see today is through utilizing Anthropic's Claude code, but there, of course, will be some transferable skills there as well. And then we'll… and then if we have some time at the end of the session, we'll dedicate that to Q&A. And as mentioned, there will be that optional Feely demo

Now, who is the man you see on your screen? Renzi Jungmun has he's the founder of Liberty 91, and he's graced us with his expertise and presence today. But I'll let the man introduce himself. So, Renzi, over to you, who are you?

Thank you, Josh. It's great to be here. Yep, my name is Renzo Jungmann. I am from the Netherlands. My background is in law enforcement. Originally, I used to be a police detective, and that's where I started my sort of cyber career, if you will. Most of my career was spent with Mandiant, which then became Google, and my job was to build threat intelligence teams

Let's see, camping in the mountains of Rossakheima in the north of the UAE with my daughters

And the first one is the highlight of my year so far has been

Damn, that's a very good answer. It sounds like a fantastic moment for you and the family. Number two, the most annoying thing about AI is

Number three, and finally, the future of humanity is

Excellent, excellent. I love the optimism. With that, I will be transferring control over to you, but we're first going to quiz the audience. So to help us tailor this session to the types of Claude skills that interest you the most, we have a question for you, and this is going to be an audience Zoom poll. It should have popped up on your screen.

So which cloud skill categories interest you the most? Are you interested in ones to help with collection, Intel tradecraft, the relevancy check so that asking so what question intel requirements, Intel production or integrations.

And Renzi, as people answer, I will stop screen sharing and let you take over the screen share.

And then I will let you know what the results are looking like.

So that's a fairly even spread with a slight lead on intellectual tradecraft

And with that, Renzi, and with that, we'll close at the poll and I'll hand it over to you, Renzi. Take it away.

Awesome. Yeah, that's one of the most important ones as well. And one of the most fun ones to talk about, I think. Let's see. There he is. Cool. And that sort of reflects why we're here as well. Our jobs, our profession is difficult. And it doesn't scale very well. And that's also what we will be taught in the sort of the previews and the thesis for this particular webinar

Analyst can only really do one analysis at a time. It doesn't scale and it is really complex. We do we apply analytic tradecraft, our analytical skills what we've been trained on as analysts on highly technical content. And that

So for us to be able to do that, we have to

that is the MitraTech framework is a framework that we use to essentially document every possible technique that a bad guy can use to hack someone else, and it's mapped against sort of a timeline, an attack kill chain, if you will, from beginning to end from reconnaissance all the way to obtaining their objectives

With all the defensive evasion and infrastructure skills in the middle, 600 of them, more of them, no one knows all of those that's not something you can remember

political analysis background. But then you have to apply that to a technical content and that's also hard. So those people typically end up in more strategic roles and strategic intel roles. But you have to learn each other's craft. So it's it's very hard. And then you have to do all the engineering tasks as well. Maybe they have automations running that break all the time. You have to chew on your threat intelligence platforms

And that's that's very often a full-time job within a team as well, and most teams are small. So there's just all of those things

the onslaught of news and events and RFIs, requests for intelligence, and keeping up with

Security events and assessing the relevance, and then collecting additional data and applying analyst trace craft and producing tailored intelligence

But I don't think AI can fully replace analysts and I don't think that's the approach either. That should not be the mindset where we're going. I think even we talked about AI slop already

Sorry, quick question. I'm going to jump in and ask a more like foundational question. But what? But why do you advocate Claude code over, let's just say using the Claude desktop app desktop app, or even the web browser app

And then there's the get ignored that you can ignore. Okay, so if we go to the Claude folder, then you can see that there is a skills folder. That's where your skills live. And there's 2 of them already here. Extract iocs and MISP integration

So, whatever you put in, the output is going to be relatively consistent every time

So to show you what that looks like for every skill that you build or import

And then it gets to work. So now I was doing is starting to extract the IOCs from that report.

When it came to creating that skill, what was your process there? Was it just taking a prompt and then like, you know, kind of adapting it to suit a skill format or was there more to it?

on another report, I get the exact same format. It does the exact same thing most of the time

Because it shows a little bit more of the meat around what a skill can be. We have the same couple of folders here, but also the same skill.md. This is about a MISP integration. If you don't know what MISP is, it stands for Malware Intelligence Sharing Platform.

free and open source platform that you can download and use for free, and developed and maintained by Circle in Luxembourg. These guys are awesome. It's been around for decades. It looks like this. It's essentially a database where you can store your threat intelligence data, or your events, or anything that

is relevant to you. I've got a couple of them here as well, but 600, and you can collaborate and share information with other people that also use MISP.

Now, within clothes or cloth in general, you have a couple of models. Haiku is the smallest model, I guess, the least capable. Then you have Sonnet, Opus, and then Fable. And Fable is the best one, also very expensive, and Hyper is a lot more affordable, and you can do a lot more. It's also faster

This indicator is already known. If you use the skill, you can ask, is this indicator in my MISP

Use this skill in this way, and that script, sorry, use the script in this way. And that script is here. So not all the information is in skill.md anymore, but it is now pointing to this particular script

That's in the script file. So there can be multiple scripts there. And then the skill MD is essentially your sort of phone book of when to use what exactly in the

that points to the relevant information in the references folder for when you need it. So you don't have to load all of the information, just the relevant information that you need.

And we can also have the attribute types here, for example, that are present within the platform MISP. And we also can also have assets. So in this case, that's a template for when you upload new information to the platform.

That's okay, this is all part of the live demo.

Yeah, so now we're going to, I've shown you two, but they were pre-created and we want to create our owns, right? So we're going to do one on the Migrate tech technique framework. A very simple one. You don't want to use this in real life, but it's just to show you what it potentially looks like. So we're going to call it

And then, of course, we need a new file in there. That's called skill.md. Capital letters. That's important.

And then disable model invocation. You may have seen this in the other ones. This essentially tells the agent not to just use this whenever it feels like it. It has to be asked for by the user.

You don't necessarily have to use slash the name of the skill. You can also say, hey, go ahead and find some Mitra attack techniques in this report

Yeah, that works. All right. So let's give it a description. So we can say this

Model is for extract, or the skill is for extracting

And then some description that I'm just going to copy paste here for time's sake. And the instructions are read the report at argument number one for each attacker behavior it describes, identify the attack

It only includes a technique, as the report

Oh, there we go. See, you see the results coming in

from this particular report. That was really quickly. Again, this is probably faster to create a skill and then run it than to go into the report and find them manually.

I think you spent about five minutes on that and the amount of manual work that saves, especially the more that you use it and repeat its use. Yeah, it's huge ROI.

But we don't necessarily know what the inside of a sticks bundle looks like, or we don't know what JSON looks like, right? So we don't have to. So what do we do? We look at the documentation.

Now, I want this skill to be able to identify sticks domain objects mentioned in the report, B, identify sticks cyber observable objects, and C sticks relationships between those objects as well as the properties of each of them

identifying the IOCs or describing the TTPs or finding anything that you didn't mentioned vulnerabilities with named threat actors, assets that are described that are vulnerable to a certain thing, regions that are targeted, source countries where a threat is coming from, etc. You can enrich things any way you

Often go there when there's an alert in a SOC and they want to check if an IP address or a domain in that alert is malicious or not, or at least find more context around it. This is a place where you can go. And that's useful and it gives you quick results and you can also create a skill for that

indicators that I've extracted using the extract IOC skill and use that information for further follow-up analysis

We have another skill in progress that's being made for integrating with this. So that's an integration skill. Again, I'm doing this very rudimentary, quick and dirty way, but just to show you how you

or a vendor list, for example, or your control architecture, etc. And then when you have that skill, you can use it to check everything that comes in

For your organization, or if you have you work for like a group or conglomerate of organizations, you can have one of these for different business units. Or if you work for an MSSP for each individual customer that you have that all have their different

So I have this folder here under source material that says institutional knowledge documents. And as I mentioned, our organization for this demo is Acme Aviation. I have my information security policy here, an audit report

There’s real pressure on CTI analysts to increase productivity. To achieve this, a lot of us are exploring AI Agentic Skills and while they have potential, they carry risk without proper guardrails.

In this webinar, we explore how we can create AI Agentic Skills suitable for threat intelligence work. We’ll use Claude Code to demonstrate how we can develop

and organize AI Agents, loaded with very specific Skills, to help us scale our output as (often small) CTI teams.

Create AI Skills that are tailored to specific tasks with intelligence tradecraft and have important guardrails

Deploy agents to take care of the “CTI grind work” so you can focus on the much more important and interesting investigations

Find and run dozens of ready-to-use CTI Agentic Skills (free community resource)

For a deeper dive, check out Renze’s blog, 

Building AI agentic skills suitable for threat intelligence work

. It walks through building your own skills so your tradecraft runs the same way every time, at scale, across collection, relevance checks, analysis, and reporting.

https://platform.liberty91.com/auth/create-account

https://github.com/Liberty91LTD/cti-skills

Renze Jongman - renzejongman@liberty91.com

Certificates of attendance for this session were sent to attendees on Friday, September 25, from cti-sessions@feedly.com

Yes, as long as there is data to support that relationship. You would have to combine a couple of things to make them come together though. You would need one skill that knows how to talk to your TIP, then another that knows STIX. You could then essentially start asking questions like: “go over every Threat Event in my TIP over the last 7 days. Identify STIX model objects in the content and possible relationships between them. Add those relationships to the STIX bundle.” It would be wise to put some guardrails in between, like what constitutes a relationship for you, and what confidence threshold you require for it to suggest a relationship. You could also build in a lookup with another tool to try and see if you can strengthen the relationship. For example: if a report 

 a hardcoded domain in a particular malware sample, you could choose to have a skill run that sample (or hash) through a sandbox to verify.

Yes! Personalization is a huge part of Feedly’s product offering. Try it for yourself at: 

https://feedly.com/threat-intelligence/book-demo

 is what matters. Nothing in those skills is specific to Claude or any of the Anthropic models, but what you need is a harness (like Claude Code) that works with skills, loads them from a directory, and can run shell scripts and read files.

 against local models. I would invite the asker to do that and open a PR or GitHub issue with the results.

Yes, you’re right. There are essentially three ways to trigger an analysis:

 which is whenever you want to ask. That’s what we’ve covered in the webinar.

 You could run a cron job that starts a script (which you could ask claude to write) to pull samples or reports and feeds them through your pipeline

 whenever ‘something happens’, like a new incident, or malware or report gets published, it immediately triggers the pipeline. One of the ways to do that is to expose a webhook and point your triggering logic to it.

The next step would then be to make sure that the process runs the way you expect in the pipeline. You could have multiple little scripts calling claude (check out using claude on the command line using the -p flag. So an example would be:

claude -p "investigate 203.0.113.42 and save the report to reports/203-0-113-42.md" \ --dangerously-skip-permissions \ --output-format json

You could then use a tool like inotify on Linux (for example) to run another follow-up prompt, based on that file being created (or modified). Or, you could build the whole thing as one potentially complex workflow in Claude Code that does all the decision-tree work for you.

You don’t have to put all those reports in the 

 file. Instead, store them in the references sub-folder, and POINT to them in 

 So if you have reports in there that describe the structure of the Iranian Revolutionary Guard Corps (IRGC), for example, you could point to that with ‘If the user wants to know about the structure of the IRGC, inspect this file here: references/irgc_strucuture.txt’.

Yes, the pack works in any Agent Skills-compatible harness, Hermes included. The benefits in the Hermes case specifically, are that its easier to schedule certain tasks, without setting up cron-jobs with claude -p, like we discussed before. Hermes also has a (more) persistent memory across sessions. Be careful with the automatic skill creation feature though: Hermes creates skills on its own after successfully completed a complex task (5 steps or more). That’s convenient, but also makes it less reliable to be consistent and as analysts, we typically like our work to be auditable. We haven't tested it with Hermes ourselves; please try and let us know!

Educational guidance and demo of how to create agent skills for CTI. 

CTI Sessions

Upcoming live sessions

Five tools, all free: Live demos by the CTI pros who created them

Past sessions

Beyond the SOC: Using threat intelligence to uncover fraud

Scaling with Skills: How to create and organize Agentic Skills for CTI

What's new in Feedly: 2026 mid-year product update for CTI teams

Turning CTI into detection: Operationalizing ATT&CK for practitioners

Proving CTI value: Metrics program leaders need to communicate impact

How to manage burnout for a sustainable cybersecurity career

What is SANS FOR478? Sneak peak at the course content

Tailor CTI prompts to your industry: Build for your workflow and stakeholders

Certifications, education, and the many paths into threat intelligence

Better tabletops: How threat intelligence makes exercises worth running

Cybercrime trends and tradecraft

Promotions and pivots: Practical advice on CTI career strategy

Advanced AI prompting for CTI: From theory to practice

What CTI practitioners are planning for 2026

6 CTI workflow improvements for 2026: Tips from our TI Advisors

Building smarter CTI workflows with MCP servers

From malicious packages to actionable intelligence with OpenSourceMalware

From threat intel to threat hunts: Scaling CTI operations efficiently

Trick or breach: Horror stories from CTI Analysts

Beyond queries - AI prompting techniques for CTI analysts

Visualize attack chains from threat reports automatically

Threat Intelligence in Action: Fast-tracking CTI at AutoZone

Maturing CTI’s role in mitigating supply chain risk

Cyber risk in perspective: What the data reveals about breaches and business impact