Applied AI in Cyber Threat Intelligence: Build agentic workflows to scale the intelligence lifecycle

Transform cyber threat intelligence operations with multi-agent AI workflows. Automate intelligence collection, corroborate threat signals, apply structured analysis, and produce tailored, high-fidelity intelligence at scale.

Key Features

• Build multi-agent AI pipelines to automate the cyber threat intelligence lifecycle
• Automate threat intelligence workflows for collection and cross-source corroboration
• Apply Structured Analytic Techniques to automated threat intelligence workflows

Book Description

Cyber threat intelligence teams face growing volumes of data, evolving adversaries, and increasing demands for timely analysis. Applied AI in Cyber Threat Intelligence is your engineering toolkit for transforming manual intelligence processes into scalable workflows using agentic AI and Python.

Designed for threat intelligence analysts, security engineers, and SOC practitioners, this book takes a practical approach to operationalizing threat intelligence with multi-agent AI systems. You will build specialized AI agents that automate the intelligence lifecycle. Using the Google Agent Development Kit (ADK) alongside Machine Learning techniques, you will build automated systems that score intelligence requirements, generate structured collection plans, and corroborate cross-source signals to determine breach fidelity.

You will also integrate Structured Analytic Techniques (SATs) into your AI pipelines to mitigate cognitive bias. You will build agents that generate visual argument maps, tailor intelligence products for different audiences, automate secure primary research, forecast threat actor behavior, and strengthen threat hunting operations. By the end of this book, you will be able to develop practical AI-powered cyber threat intelligence workflows that improve scale, consistency, and decision support.

What you will learn

• Build multi-agent AI pipelines for CTI workflows
• Automate intelligence requirements and collection planning
• Corroborate cross-source threat signals to score breach fidelity
• Scaffold Structured Analytic Techniques with AI agents
• Generate argument maps and tailored intelligence reports
• Automate secure primary research, forecasting, and threat hunting

Who this book is for

This book is for cyber threat intelligence analysts looking to scale their daily workflows with agentic AI and automation. Security engineers, detection engineers, and SOC practitioners seeking to automate intelligence operations will also benefit. To get the most out of the hands-on projects, you should have an intermediate understanding of cybersecurity, experience with threat intelligence methodologies, and basic Python 3.x scripting skills. No prior expertise in AI expert is required.

Table of Contents

1. Applying the Intelligence Lifecycle to Cybersecurity
2. Scoping Automation for Threat Intelligence
3. Discovering Data Management Principles
4. Grasping Machine Learning Fundamentals
5. Diving Into Artificial Intelligence
6. The Requirements Stage – Architecting and Prioritizing Intel Needs
7. The Collection Stage – Automating Data Discovery and Source Mapping
8. The Processing Stage – Validating and Corroborating Signals
9. The Analysis Stage – Scaffolding Structured Analytic Techniques (SATs)
10. The Production Stage – Visualizing Logic and Argument Mapping
11. The Dissemination Stage – Tailoring Intelligence to Stakeholders
12. The Feedback Stage – Closing the Loop with Continuous Improvement
13. Machine Learning for the Threat Intelligence Lifecycle
14. Automating Threat Hunting Campaigns
15. Integrating Threat Intelligence with Detection Engineering
16. Automating Tactical Research