Aaron Kaplan
Aaron Kaplan worked at cert.at for 12 years before reactivating his sole-proprietorship in 2020.
Since 2018 he has been fascinated by the possibilities, problems and pitfalls of AI for cybersecurity. He co-chairs the AI SIG at FIRST.org. Co-maintainer of IntelMQ.
Session
LLMs are great for specific tasks in understanding (unstructured or even semi-structured) CTI reports.
However, very often one can not simply send out corporate CTI infos to the large public AI frontier models. Regulation, security and privacy concerns mandate local models.
Luckily, now some local LLM models are fully capable of understanding CTI Reports, understanding MISP EventReports, MISP events and they can even suggest the proper MISP tagging.
The new MISP "ai-connector" (https://github.com/MISP/ai-connector) is available and suitable for everyone who is capable for running a local ollama, vllm, LMStudio or similar. It gets even better: models such as qwen3.8 are extremely good at image as well as NLP tasks. The "ai-connector" module was written, tested and benchmarked against models such as qwen3.8 and is now part of the MISP eco-system.
In this workshop, participants will learn how to install it, configure it and make MISP "local-AI ready".