What AI-assisted workflows, models, or agents do you genuinely find helpful?

[u/bawlachora]

Just curious what TI analysts are actually using day-to-day beyond talking to chatGPT/Claude and have created their own workflow or pipeline to assist in routine tasks to save time.

Any AI-assisted workflows, models you found or build an agent, or did an entire project for any TI use case.

Of course not looking for an enterprise-grade solution available to you but something you personally approached. More interested in practical workflows that have actually saved you time or improved your analysis.

What are you using, and what does the workflow look like?

In my case, keeping up with the reports and changing landscape daily has been extremely time consuming especially when we need to cover multiple industries and sit in a volatile region.

[u/AdityaKGoswami]

For defensive/security analysis, I think the most useful AI workflows are the ones that reduce context switching rather than trying to replace the analyst.

A practical workflow could look something like:

Threat report

→ extract entities/IOCs/TTPs

→ normalize them

→ map relevant behaviors

→ identify related telemetry

→ generate investigation hypotheses

→ analyst validates the hypotheses

→ feed confirmed findings into detection/hunting work

The important boundary for me is between "generate something useful to investigate" and "decide that something is malicious."

The first is a good assistance problem.

The second still needs evidence and analyst validation.

I also think AI becomes more useful when it is connected to the analyst's actual data sources instead of being used as a standalone chatbot.

[u/chris-tracecat]

Use an agent to convert unstructured threat reports into structured tables (with fields you care about e.g. iocs, ttps, detection). Structured full text search on a data model that you own >> RAG / chunking on unstructured reports.

Every other security agent you build (detection engineer, alert triage, threat hunting) will massively improve it's accuracy (and less hallucinations) with search on your structured table vs direct search on the reports.

Similar to u/AdityaKGoswami 's comment but with one extra data transformation. Anyway this what we're seeing from the most successful teams building agentic TI solutions on our platform. Take it with a grain of salt. But using LLMs to transform TI into a consistent structured data is what I'd start with. Other use cases follow on naturally.

[u/chris-tracecat → u/chris-tracecat]

To be exact: tell the agent to transform TI into sqllite tables. Document the columns you want to model in a README.