Cyber threat intelligence is often hidden inside unstructured sources such as security blogs, advisories, and open-source reports. Although these sources contain valuable information, manually turning them into actionable intelligence is slow, difficult, and not scalable.

STS, within CyberNEMO, proposes an automated pipeline that transforms open-source cyber threat intelligence into structured and usable knowledge. The pipeline combines deterministic methods with Generative AI to support the full process: scraping threat reports, extracting relevant information, converting it into STIX 2.1 objects, storing it in OpenCTI, and using it for threat hunting and response.

The system uses a modular Python architecture and Docker-based deployment to connect different tools in a reproducible way. Stixify is used to convert raw text into structured STIX objects, while OpenCTI currently acts as the central knowledge base for visualization, sharing, and standardization.

The main contribution is showing that Generative AI can strengthen cyber defense when combined with existing standards and tools. Deterministic methods remain useful for clear indicators of compromise, while AI helps extract context, relationships, and more complex threat patterns.

Overall, STS’ initial work shows a practical path toward proactive cyber defense: transforming unstructured threat information into standardized intelligence that can support faster analysis, hunting, and response.