[{
    "url": "/blog/proposal_for_sigma_investigation_guides/",
    "title": "A Proposal for Sigma Investigation Guides for Agents",
    "description": "A proposal for a portable Sigma Investigation Guide format that helps security agents and analysts investigate alerts consistently, auditably, and across platforms.",
    "image": "/assets/images/blog/2026-07-20/proposal_for_sigma_investigation_guides.png"
  },{
    "url": "/blog/what_is_pap_why_does_it_matter_cti/",
    "title": "What is PAP, and Why Does it Matter in Cyber Threat Intelligence?",
    "description": "PAP explains what recipients are allowed to do with intelligence, not just who they can share it with. This post covers why that distinction matters and how OASIS models PAP in STIX 2.1.",
    "image": "/assets/images/blog/2026-06-15/what_is_pap_why_does_it_matter_cti.png"
  },{
    "url": "/blog/why_vulmatch_models_cwes_stix_weakness_objects/",
    "title": "Why Vulmatch Models CWEs as STIX Weakness Objects",
    "description": "Vulmatch models CVEs and CWEs as first-class STIX objects. This post explains why coupling a CVE to a CWE reference is not enough, how cwe2stix defines a Weakness SDO, and what that unlocks in practice.",
    "image": "/assets/images/blog/2026-05-17/why_vulmatch_models_cwes_stix_weakness_objects.png"
  },{
    "url": "/blog/representing_admiralty_codes_in_stix/",
    "title": "Representing Admiralty Codes in STIX Without Giving Up Interoperability",
    "description": "A practical approach to modelling Admiralty Codes in STIX 2.1 using Marking Definitions and Extension Definitions, with reusable objects you can adopt in your own CTI workflows.",
    "image": "/assets/images/blog/2026-04-13/representing_admiralty_codes_in_stix.png"
  },{
    "url": "/blog/introducing_cyber-threat_exchange/",
    "title": "Introducing the Cyber Threat Exchange: A Better Way to Publish and Consume CTI Feeds",
    "description": "Learn how the Cyber Threat Exchange helps researchers publish structured CTI in STIX 2.1 and lets defenders operationalise specialist intelligence through TAXII, APIs, and existing CTI tooling.",
    "image": "/assets/images/blog/2026-03-16/introducing_cyber_threat_exchange.png"
  },{
    "url": "/blog/ttps_are_missing_the_p/",
    "title": "TTPs Are Missing the P: Lets Fix That",
    "description": "Most ATT&CK programs model tactics and techniques, but not procedures. This post explains why that gap matters, where Attack Flow helps, and how STIX could model the missing layer.",
    "image": "/assets/images/blog/2026-02-23/ttps_are_missing_the_p.png"
  },{
    "url": "/blog/using_known_attck_techniques_to_predict_attack_paths/",
    "title": "Using Known ATT&CK Techniques to Predict What Came Before and What Happens Next",
    "description": "Known ATT&CK techniques are not just for labeling incidents. This post shows how to use them as anchors to infer likely predecessor and successor behavior in a realistic adversary sequence, and how MITRE TIE can support that workflow.",
    "image": "/assets/images/blog/2026-02-16/using_known_attck_techniques_to_predict_attack_paths.png"
  },{
    "url": "/blog/detection_isnt_defence_linking_attck_d3fend/",
    "title": "Detection Isn’t Defence: Linking ATT&CK to D3FEND",
    "description": "D3FEND becomes far more useful when it is not isolated. This post shows how D3FEND links to ATT&CK and CWE through artefacts, so you can traverse from offensive technique or weakness to concrete defensive mitigations.",
    "image": "/assets/images/blog/2026-02-09/detection_isnt_defence_linking_attck_d3fend.png"
  },{
    "url": "/blog/stop_wasting_agent_tokens_on_attck_lookups/",
    "title": "Stop Wasting Agent Tokens on ATT&CK Lookups",
    "description": "Most AI CTI workflows waste tokens rediscovering ATT&CK, CWE, CAPEC, and other CTI knowledgebases from scratch. CTI Butler fixes that by giving agents a structured retrieval layer. In this post I show how to turn it into a Claude Code skill that recommends likely mappings from raw analyst input.",
    "image": "/assets/images/blog/2026-02-02/stop_wasting_agent_tokens_on_attck_lookups.png"
  },{
    "url": "/blog/making_stix_extensions_practical_using_stix2extensions/",
    "title": "Stop Reinventing STIX Objects: A Practical Way to Build and Share Extensions",
    "description": "Learn how to avoid ad-hoc custom objects by generating schemas and Extension Definitions automatically with stix2extensions, keeping STIX extensions interoperable by default.",
    "image": "/assets/images/blog/2026-01-19/making_stix_extensions_practical_using_stix2extensions.png"
  },{
    "url": "/blog/we_made_d3fend_work_in_stix/",
    "title": "We Made D3FEND Work in STIX",
    "description": "D3FEND was not built for STIX, but most CTI tooling depends on it. This post walks through how we model D3FEND as STIX 2.1 so defensive knowledge can finally behave like first-class CTI data.",
    "image": "/assets/images/blog/2025-12-15/we_made_d3fend_work_in_stix.png"
  },{
    "url": "/blog/opencti_is_not_stix_database/",
    "title": "OpenCTI Is Not a STIX Database",
    "description": "Why STIX 2.1 bundles don’t ingest the way you expect, and what we learned building production OpenCTI pipelines.",
    "image": "/assets/images/blog/2025-12-01/opencti_is_not_stix_database.png"
  },{
    "url": "/blog/d3fend_for_people_who_know_attck/",
    "title": "D3FEND for People Who Already Know ATT&CK",
    "description": "An ATT&CK-native introduction to MITRE D3FEND: how defensive tactics, techniques, artefacts, and relationships mirror attacker behavior and complete the picture.",
    "image": "/assets/images/blog/2025-11-17/d3fend_for_people_who_know_attck.png"
  },{
    "url": "/blog/modelling_nova_rules_structured_cti/",
    "title": "Modelling NOVA Rules as Structured CTI",
    "description": "This proof of concept shows how adversarial prompts from PromptIntel can be transformed into structured STIX intelligence by treating prompts as observables and NOVA rules as behavioural Indicator logic.",
    "image": "/assets/images/blog/2025-10-31/modelling_nova_rules_structured_cti.png"
  },{
    "url": "/blog/build_custom_attck_navigator_layer/",
    "title": "Using the ATT&CK Navigator with non-ATT&CK frameworks",
    "description": "The ATT&CK Navigator isn’t limited to ATT&CK. In this post, we break down the STIX properties the Navigator actually uses and show how to build a custom MITRE ATLAS matrix that renders cleanly inside it.",
    "image": "/assets/images/blog/2025-10-20/build_custom_attck_navigator_layer.png"
  },{
    "url": "/blog/modelling_ai_prompt_compromise_in_stix/",
    "title": "When Prompts Become Indicators: Modelling Prompt Compromise in STIX",
    "description": "A practical approach to representing Indicators of Prompt Compromise (IoPC) in STIX, introducing prompts as first-class observables, separating intent through Indicators, and linking activity to MITRE ATLAS techniques for intelligence sharing and detection.",
    "image": "/assets/images/blog/2025-09-22/modelling_ai_prompt_compromise_in_stix.png"
  },{
    "url": "/blog/graph_credit_card_fraud_using_stix/",
    "title": "Graphing Credit Card Data Leaks Using STIX 2.1 Objects",
    "description": "Turn card numbers into STIX 2.1 objects. Enrich the data with issuer information. Track transactions made by the card. Then link the cards and transactions to other STIX objects in your research (Actors, Incidents, etc.).",
    "image": "/assets/images/blog/2025-08-18/graph_credit_card_fraud_using_stix.png"
  },{
    "url": "/blog/stix_graph_ransomware_crypto_ransom_payments/",
    "title": "Graphing the Ransomware Payment Ecosystem using STIX Objects",
    "description": "I recently conducted a project to identify the most prolific ransomware based on the ransom payments being made. Let me walk you through how I did it.",
    "image": "/assets/images/blog/2025-07-14/stix_graph_ransomware_crypto_ransom_payments.png"
  },{
    "url": "/blog/turn_any_blog_into_structured_threat_intelligence/",
    "title": "Turn any Blog Post into Structured Threat Intelligence",
    "description": "Obstracts is the blog feed reader used by the worlds most targetted cyber-security teams. Let me show you why.",
    "image": "/assets/images/blog/2025-06-16/turn_any_blog_into_structured_threat_intelligence.png"
  },{
    "url": "/blog/full_text_full_history_rss_atom_blog_feeds/",
    "title": "Full Text, Full Archive RSS Feeds for any Blog",
    "description": "RSS and ATOM feeds are problematic (for our use-cases) for two reasons; 1) lack of history, 2) contain limited post content. We built some open-source software to fix that.",
    "image": "/assets/images/blog/2025-05-12/full_text_full_history_rss_atom_blog_feeds.png"
  },{
    "url": "/blog/using_attack_flow_model_procedure_layer_missing_in_attck/",
    "title": "Using Attack Flow to Model the Procedure Layer Missing in ATT&CK",
    "description": "Tactics and techniques are not enough on their own. Learn why procedures are the missing operational layer in ATT&CK, and how to model procedure-level attack paths in STIX with Attack Flow.",
    "image": "/assets/images/blog/2025-04-28/using_attack_flow_model_procedure_layer_missing_in_attck.png"
  },{
    "url": "/blog/adding_sigma_detection_rules_into_attack_flows/",
    "title": "Using Sigma Rules in Attack Flows for Detection Coverage and SOC Triage",
    "description": "This post shows a simple way to link Sigma detections to Attack Flow steps so analysts can see what fired, where they are in an attack path, and what coverage is missing.",
    "image": "/assets/images/blog/2025-04-14/adding_sigma_detection_rules_into_attack_flows.png"
  },{
    "url": "/blog/understanding_structure_attack_flows_to_model_cti_reports/",
    "title": "Beyond the ATT&CK Matrix: How to Build Dynamic Attack Flows with STIX",
    "description": "MITRE ATT&CK techniques are useful, but they don’t capture the sequence of an attack. Enter Attack Flows.",
    "image": "/assets/images/blog/2025-03-17/understanding_structure_attack_flows_to_model_cti_reports.png"
  },{
    "url": "/blog/beginners_guide_to_using_sigma_cli_pysigma/",
    "title": "An Introduction pySigma: Converting Sigma Rules to Work with Your SIEM",
    "description": "Learn how to seamlessly convert Sigma Rules into queries for your SIEM. Follow along with real examples.",
    "image": "/assets/images/blog/2025-02-10/beginners_guide_to_using_sigma_cli_pysigma.png"
  },{
    "url": "/blog/writing_advanced_sigma_correlation_rules/",
    "title": "Writing Advanced Sigma Detection Rules: Using Correlation Rules",
    "description": "Correlation Rules allow you to detect threats by linking multiple events together based on a meaningful relationship.",
    "image": "/assets/images/blog/2025-01-13/writing_advanced_sigma_correlation_rules.png"
  },{
    "url": "/blog/writing_effective_sigma_rules_for_beginners/",
    "title": "Writing Effective Sigma Detection Rules: A Guide for Novice Detection Engineers",
    "description": "Sigma Rules are becoming more widely adopted as the standard detection language. Learning how to write them is not difficult. Let me show you.",
    "image": "/assets/images/blog/2024-12-16/writing_effective_sigma_rules_for_beginners.png"
  },{
    "url": "/blog/bad_software_keeps_security_industry_in_business/",
    "title": "Bad Software Keeps Cyber Security Companies in Business",
    "description": "Despite countless frameworks, best practices, blog posts... so many developers still hardcode credentials into their code.",
    "image": "/assets/images/blog/2024-11-18/bad_software_keeps_security_industry_in_business.png"
  },{
    "url": "/blog/enriching_vulnerabilities_using_cwe_capec_attck_epss_kev_stix/",
    "title": "Enriching Vulnerabilities to Create an Intelligence Graph",
    "description": "We do a lot of our research into vulnerabilities. To aid this, we enrich CVEs using many remote sources of intelligence.  Here is a walk-through showing how we connect CVEs to EPSS scores, CISA KEVs, MITRE ATT&CK, CWEs, and CAPECs.",
    "image": "/assets/images/blog/2024-10-14/enriching_vulnerabilities_using_cwe_capec_attck_epss_kev_stix.png"
  },{
    "url": "/blog/writing_stix_patterns_to_identify_vulnerable_products/",
    "title": "Writing Detection Rules to Identify if Products in my Stack are Vulnerable",
    "description": "Developing on last weeks post, I show you how to construct STIX Patterns to automatically flag which products are affected by published CVEs.",
    "image": "/assets/images/blog/2024-09-16/writing_stix_patterns_to_identify_vulnerable_products.png"
  },{
    "url": "/blog/how_known_affected_software_configorations_in_cves_are_created/",
    "title": "How Known Affected Software Configorations on the CVE Website are Constructed",
    "description": "I wanted to write detection rules to identify what products are vulnerable to a CVE. In this post I walk you through my research.",
    "image": "/assets/images/blog/2024-08-12/how_known_affected_software_configorations_in_cves_are_created.png"
  },{
    "url": "/blog/mitre_attck_data_structure/",
    "title": "PSA: MITRE ATTCK is More Than Tactics and Techniques",
    "description": "Software, Data Sources, Data Components, Campaigns, and more, make MITRE ATT&CK even more powerful than you might first realise. In this post I uncover the parts of ATT&CK you might not be aware of.",
    "image": "/assets/images/blog/2024-07-15/mitre_attack_data_structure.png"
  },{
    "url": "/blog/atlas_stix_based_framework_for_ai/",
    "title": "Fortifying AI: How MITRE ATLAS Shields Artificial Intelligence from Adversarial Threats",
    "description": "Discover how MITRE ATLAS is helping to defend AI systems as I share a detailed explanation of how the knowledge-base is architected.",
    "image": "/assets/images/blog/2024-06-17/atlas_stix_based_framework_for_ai.png"
  },{
    "url": "/blog/disarm_stix_based_framework_for_disinformation/",
    "title": "Fighting Disinformation: Classifying Your Research Using Standardised Disinformation Tactics and Techniques",
    "description": "Our intel team is increasingly using the DISARM framework to classify parts of our research as disinformation campaigns continue increase. In this post I will introduce the DISARM data structure.",
    "image": "/assets/images/blog/2024-05-13/disarm_stix_based_framework_for_disinformation.png"
  },{
    "url": "/blog/modelling_locations_as_stix_objects/",
    "title": "The Problems with Modelling Countries as STIX Objects (and How to Fix Them)",
    "description": "Take the list of recognised countries and regions. Create STIX objects for them. Make them available to everyone so that the CTI world has a single way of representing them.",
    "image": "/assets/images/blog/2024-04-15/modelling_locations_as_stix_objects.png"
  },{
    "url": "/blog/how_ctibutler_works_joining_knowledgebases/",
    "title": "How CTI Butler Creates a Threat Intelligence Graph of Common Frameworks",
    "description": "CTI Butler links many common knowledge bases, for example linking MITRE ATT&CK to CAPEC objects, to improve the context of our research. This post describes the logic CTI Butler employs behind the scenes to do this.",
    "image": "/assets/images/blog/2024-03-11/how_ctibutler_works_joining_knowledgebases.png"
  },{
    "url": "/blog/we_built_mitre_attck_api/",
    "title": "CTI Developers: We Built an API for MITRE ATT&CK, CWE, CAPEC, ATLAS... and more!",
    "description": "Here is a quick-start guide to CTI Butler showing you how much easier it makes working with these frameworks.",
    "image": "/assets/images/blog/2024-02-12/we_built_mitre_attack_api.png"
  },{
    "url": "/blog/getting_started_attck_navigator/",
    "title": "Getting Started with the MITRE ATT&CK Navigator",
    "description": "The MITRE ATT&CK Navigator is a very useful tool to explore the MITRE ATT&CK (and other similar frameworks). In this post I take a look what you can do with Navigator and how it works under the hood so that you can use it to model your own ATT&CK-like frameworks.",
    "image": "/assets/images/blog/2024-01-15/getting_started_attack_navigator.png"
  },{
    "url": "/blog/building_custom_attck_content_with_workbench/",
    "title": "How to Build Custom MITRE ATT&CK Content Using Workbench (Step-by-Step Guide)",
    "description": "A practical Workbench guide: extend ATT&CK, link objects to techniques, and publish collections other teams and tools can consume.",
    "image": "/assets/images/blog/2023-12-11/building_custom_attack_content_with_workbench.png"
  },{
    "url": "/blog/stix_shifter_turning_stix_pattern_into_siem_queries/",
    "title": "STIX Shifter: Turning STIX Patterns into SIEM Queries",
    "description": "Learn how to translate STIX detection patterns into SIEM queries using STIX Shifter, and convert detections back into STIX Observed Data for evidence and correlation.",
    "image": "/assets/images/blog/2023-11-13/stix_shifter_turning_stix_pattern_into_siem_queries.png"
  },{
    "url": "/blog/constructing_stix_indicator_patterns/",
    "title": "How to Write STIX Indicator Patterns for Real Detection Rules",
    "description": "Learn how to turn threat intelligence into actionable detection rules. Learn how to build behavioral detection using STIX Patterns, and link sightings to evidence.",
    "image": "/assets/images/blog/2023-10-16/constructing_stix_indicator_patterns.png"
  },{
    "url": "/blog/stix_storage_for_developers_memory_files_and_databases/",
    "title": "STIX Storage for Developers: Memory, Files, and Databases",
    "description": "A practical guide to storing and querying STIX 2.1 data using MemoryStore, FileSystemStore, and ArangoDB — with Python examples.",
    "image": "/assets/images/blog/2023-09-18/stix_storage_for_developers_memory_files_and_databases.png"
  },{
    "url": "/blog/stix_extensions_in_the_wild_how_to_add_what_the_spec_forgot/",
    "title": "STIX Extensions in the Wild: How to Add What the Spec Forgot",
    "description": "How to design and ship STIX 2.1 extensions — new objects, nested props, and bundles — that your consumers will love.",
    "image": "/assets/images/blog/2023-08-14/stix_extensions_in_the_wild_how_to_add_what_the_spec_forgot.png"
  },{
    "url": "/blog/schema_chaos_and_the_art_of_stix_maintenance/",
    "title": "Schema Chaos and the Art of STIX Maintenance",
    "description": "All I wanted was EPSS and CVSS to show up in OpenCTI. Instead, I ended up reverse-engineering half its schema and building new STIX Extensions from scratch. Here’s the mildly painful but oddly satisfying journey.",
    "image": "/assets/images/blog/2023-07-10/schema_chaos_and_the_art_of_stix_maintenance.png"
  },{
    "url": "/blog/your_first_stix_object_a_developer_guide_to_stix_with_python/",
    "title": "Your First STIX Objects: A Developer’s Guide to STIX 2.1 with Python",
    "description": "The fast, code-first way to generate valid STIX 2.1 threat intelligence in Python. Covers SDOs, SCOs, relationships, versioning, and bundling — everything you need to start building and sharing structured intel like a pro.",
    "image": "/assets/images/blog/2023-06-19/your_first_stix_object_a_developer_guide_to_stix_with_python.png"
  },{
    "url": "/blog/beginners_guide_stix_objects/",
    "title": "Understanding STIX 2.1 Objects: A Foundation for Structured Threat Intelligence",
    "description": "Forget the 50-page spec. This guide explains STIX 2.1 objects—SDOs, SCOs, SROs, SMOs, and Bundles—in plain English with real threat intel examples.",
    "image": "/assets/images/blog/2023-05-15/beginners_guide_stix_objects.png"
  }]