A SoK for security operations centers: interpreting the current state of AI in cyber threat intelligence generation and sharing

A SoK study reviews the application of AI in cyber threat intelligence (CTI) generation and sharing, finding that current LLMs can assist its four steps, but each step still requires expert supervision. The authors divide this process into four steps: intelligence extraction, normalization and enrichment, encoding, and distribution; a survey of practitioners shows that the process is still predominantly manual. A pilot shows that LLMs recover only a small fraction of the indicators in the evidence and struggle to anchor claims to the given evidence; based on this, the authors propose three directions for automation research.