Blue Team | Intelligence-Driven Defense for the Real World

Why It Matters

Operational CTI turns overwhelming threat data into precise, business‑aligned defenses, enabling blue teams to act faster and reduce costly breaches.

Key Takeaways

• Operational CTI merges external feeds with internal telemetry for actionable defense
• Reducing alert fatigue requires AI‑driven enrichment and clear signal prioritization
• Effective CTI starts with business objectives, then designs focused collection pipelines
• Continuous feedback loops ensure intelligence remains relevant to incident response teams
• Open‑source platforms can automate ingestion, enrichment, and correlation for small MSSPs

Summary

The video outlines an intelligence‑driven approach to blue‑team operations, arguing that modern cyber‑threat intelligence (CTI) must evolve from static reports into an operational pipeline that turns external threat feeds and internal telemetry into concrete defensive actions. The speaker, who credits CTI with saving his career during a NASDAQ IPO, frames the discussion around building a “pipeline” that starts with clear business objectives, collects relevant data, enriches it with AI, and feeds it into detection rules, hunting queries, and response playbooks.

Key insights include the need to cut through noisy alerts by prioritizing true threats, integrating external sources such as dark‑web leaks and supply‑chain signals with internal logs, and using AI to add context quickly. The speaker stresses that CTI is not just a subscription service; it requires a feedback loop where analysts, incident responders, and risk managers validate and refine intelligence, ensuring it stays aligned with evolving adversary tactics and the organization’s risk profile.

Illustrative examples range from a small MSSP that built open‑source pipelines to serve dozens of clients, to the speaker’s own experience of leveraging CTI during a high‑stakes IPO. He also highlights how correlating a leaked credential on the dark web with internal DNS queries can surface a breach before it materializes, and how supply‑chain indicators often precede internal compromise.

The implication for enterprises is clear: without an operational CTI framework, blue teams remain reactive, overwhelmed by alerts, and vulnerable to asymmetric attacks. Investing in AI‑enhanced enrichment, open‑source tooling, and continuous feedback transforms raw threat data into actionable defense, improves risk management, and aligns security outcomes with business goals.

Original Description

Blue Team | Intelligence-Driven Defense: Lessons from Building Threat Intel for the Real World

🎙️ Gilmar Esteves, Head of Security Products, Apura

📍 Presented at SANS Hack & Defend Summit 2025

A practical look at how real-world threat intelligence is built. This session shares lessons from developing large-scale CTI and leak intelligence systems, showing how defenders can turn exposure data, telemetry, and context into faster decisions and measurable impact without losing sight of what really matters.