Step 1 – Provide the Threat Intelligence

Start with a report, notes, or threat-intelligence data from a trusted source.

You can ask AI:

Analyze this threat-intelligence report.

Extract:

- Affected technologies
- Vulnerabilities
- Indicators of compromise
- Attack techniques
- Recommended defensive actions

Separate confirmed information from claims or analysis.

Step 2 – Compare It with your Environment

Now provide some information about your own environment:

Our environment contains:

- Windows workstations
- Linux servers
- Nginx
- PostgreSQL
- Microsoft 365
- Centralized DNS and firewall logging

Identify which parts of the threat report are relevant to this environment.
Do not assume that an affected technology is present unless stated.

This turns a general threat report into something much more useful.

Step 3 – Extract Defensive Actions

Next, ask AI to convert the information into actions:

Create a defensive action list.

For each action include:

- What should be checked
- Which logs or systems should be reviewed
- What evidence could indicate exposure
- Suggested priority

For example, an item might look like:

Check: Nginx configuration
Evidence: Unexpected configuration changes
Logs: Nginx access/error logs
Action: Review configuration and investigate unexpected changes

Step 4 – Create a Security Brief

Finally, ask AI to produce a short report:

Create a one-page security brief containing:

1. Threat overview
2. Why it matters to our environment
3. Relevant IOCs
4. Relevant attack techniques
5. Recommended checks
6. Recommended defensive actions

Keep it concise and clearly distinguish facts from analysis.

You now have something that can be quickly reviewed by a security team.

The Workflow

Threat Report
     ↓
AI
     ↓
Extract IOCs & TTPs
     ↓
Compare With Environment
     ↓
Identify Defensive Actions
     ↓
Security Brief

The key advantage is context.

Instead of asking AI to simply summarize a threat report, give it information about your environment and ask it to identify what actually requires attention. Always verify important indicators and claims against the original threat-intelligence source before taking action.