# Intelmq.ai - adding ML model support to intelmq — Aaron Kaplan, Sebastian Wagner

**URL:** <https://discourse.ossbase.org/t/intelmq-ai-adding-ml-model-support-to-intelmq-aaron-kaplan-sebastian-wagner/682>\
**Category:** 2025 talks / workshops\
**Tags:** 2025, talk, hacklu\
**Created:** [August 26, 2025, 8:56am UTC](https://discourse.ossbase.org/t/intelmq-ai-adding-ml-model-support-to-intelmq-aaron-kaplan-sebastian-wagner/682 "2025-08-26T08:56:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://discourse.ossbase.org/uploads/default/original/1X/4713f3d4fec85f7513775fc2dd36f548a49f8faa.jpeg) [@system](https://discourse.ossbase.org/u/system)\
**Post date:** [August 26, 2025, 8:56am UTC](https://discourse.ossbase.org/t/intelmq-ai-adding-ml-model-support-to-intelmq-aaron-kaplan-sebastian-wagner/682/1 "2025-08-26T08:56:03Z")

</div>

**Join us at hack.lu 2025 — [Info & Registration](https://2025.hack.lu/info/)**

**Duration:** 30 min  
  
**Type:** Talk  
  
**Speakers:** Aaron Kaplan, Sebastian Wagner

**Abstract**

[IntelMQ](https://intelmq.org) is a great tool for automating structured IT security data feeds for CERTs: need to process all of shadowserver for a country? IntelMQ can easily do it. Need to alert on all vulnerable devices that shodan knows about? Sure!

But what about unstructured text? Many reports (CTI reports) contain lots of relevant information (IoCs, TTPs, etc.), but often in prose or only in semi-structured formats (hidden in a table, etc.).  
For information extraction, LLMs and other AI models (BERT, etc.) proved their merit already.

The presents will show how they extended intelmq to support  
these AI models and how the combination lends itself (semi-) automating a CTI analyst.

IntelMQ to MISP output included 😉

**Description**

Integrating “AI” into deterministic data-flow frameworks such as IntelMQ has its challenges. For example, AI tends to give stochastic answers, which might be correct or - sometimes - might not be.  
How to deal with these challenges will be also discussed.

[View on pretalx](https://pretalx.com/hack-lu-2025/talk/U3ZG7S/)

---

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [October 21, 2025, 9:26pm UTC](https://discourse.ossbase.org/t/intelmq-ai-adding-ml-model-support-to-intelmq-aaron-kaplan-sebastian-wagner/682/2 "2025-10-21T21:26:16Z")

</div>

Video available

[![](https://discourse.ossbase.org/uploads/default/original/1X/afb3f82f4624ea6efcf17fae330152fd4da612f4.jpeg "intelmq.ai - Adding ML Model Support To Intelmq - Aaron Kaplan and Sebastian Wagner & Jürgen Brandl") ](https://www.youtube.com/watch?v=IUbB9Eb4CM8)