Analysts have historically been responsible for collection (which is almost always reactive), storage, analysis, production and dissemination of intelligence products, covering a wide range of threat topics. It has been hard not just to keep all that knowledge about the threats readily available and up to date, but also to maintain proficiency in all the tools and skills involved to do the actual analysis.

With the agentic platforms of today, that's not necessary anymore. This demo will walk the audience through how they can use Claude Code (as an example - there are alternatives) and open-source skill packs like these (https://github.com/Liberty91LTD/cti-skills/) to set up and run a team of agents to get a lot more done, and free themselves up to do the important and interesting work: actual analysis. DISCLAIMER: this repo is owned and maintained by my (super small, bootstrapped start-up) company Liberty91, but it's not a vendor pitch: its a skills pack we've open-sourced for the community.

It's a set of skills analysts can deploy as a plugin in tools like Claude Code (we'll use claude code in this demo). There are various categories of those skills, focussed on analyst tradecraft, others on particular intelligence requirements, others on integrating with (open source) tools and platforms like MISP, AlienVault and VirusTotal. One quick example would focus on how to do a trend analysis across an entire MISP instance and identify patterns using the diamond model, generate stix bundles and a strategic analysis report (within minutes).