Intelligence at scale: Engineering the AI-driven CTI pipeline

Security teams are drowning in threat reports, OSINT feeds and vendor intel, but still struggle to turn that noise into timely, trustworthy intelligence that actually powers detections and incident response. At the same time, everyone is being told to "just add AI" to their workflows, with little guidance on how to do it safely, repeatably, and at scale.

In this talk, we’ll walk through how Atlassian’s CTI and Engineering teams built their intelligence pipeline that takes messy, unstructured OSINT and turns it into structured data, useful hunting leads, and measurable outcomes. Rather than a generic "LLMs for security" story, we’ll show how we engineered human-in-the-loop AI into the intelligence lifecycle end-to-end.

Using real examples from recent threat activity, we’ll demonstrate how we ingest and prioritise reports, generate and validate STIX bundles, and automatically spin up organisation-specific hunts in Splunk. Along the way, we’ll be honest about what worked, what broke, and the safeguards we had to build to keep AI-assisted outputs rigorous, explainable, and safe to rely on.

Setting the scene:​The modern CTI problem

This presentation walks through how we have applied automation and artificial intelligence across the intelligence lifecycle. Our overall structure will be broken down into an overview of how the intel team operates at Atlassian, and the data engineering enabling it.

CTI pipeline architecture and operations

We cover how new sources are onboarded, how data flows from collection through processing to consumer delivery, and how we use standardised, runbook-driven operations to keep the pipeline reliable. We’ll show how security teams plug into this ecosystem and how we measure utilisation, latency, coverage, and precision/recall across the lifecycle.

Threat reporting and OSINT collection in practice

We’ll show how we find relevant reporting, how we filter noise so analysts only see material that matters, and how we apply early automatic enrichment to add consistent structure and context before a human ever opens a report. This sets the stage for safe, effective AI use later in the pipeline.

Parsing and modelling intelligence with AI and STIX

We’ll highlight how we map content with structured dimensions, and how that structured view supports triage while reducing manual toil. We’ll take unstructured OSINT and show how we turn it into structured STIX objects that are automatically pushed back into our CTI pipeline and TIP.

AI-driven hunting and enrichment Intel Triage

Next, we shift to analysis and action. We’ll walk through AI-driven workflows that generate, execute, and document Splunk queries for our log sources based on a given threat activity. Attendees will see how we use these workflows to rapidly test for exposure, reduce false positives, and provide IR and Detection Engineering with organisation-specific context and leads.