## Pioneering AI-Driven OSINT

<div style="display: flex; justify-content: center; gap: 2em; align-items: center;">
  <span style="display: inline-flex; align-items: center; gap: 0.5em;">
    <img src="assets/Taranis.png" alt="" style="height: 2em;">
    <a href="https://taranis.ai">taranis.ai</a>
  </span>

<span style="display: inline-flex; align-items: center; gap: 0.5em;">
    <img src="assets/github.svg" alt="" style="height: 1.8em;">
    <a href="https://github.com/taranis-ai/taranis-ai">taranis-ai/taranis-ai</a>
  </span>
</div>

Note:
Welchome to "Taranis AI — Pioneering AI-Driven OSINT".
I'm Ben and i work as a...
This talk is about Taranis AI, an open-source platform for automating OSINT workflows using artificial intelligence.
I want to talk about how we combined open data, AI research, and managing the fine line between open source project management and research.

---

## What is OSINT?

> Open-Source Intelligence (OSINT) refers to the collection and analysis of publicly available information for intelligence purposes.

- Derived from publicly accessible sources (news, social media, forums)
- Common in cybersecurity, journalism, and threat intelligence
- Challenges: data volume, signal-to-noise ratio, source validation

</div>

Note:
Let’s start with a quick refresher. OSINT — Open Source Intelligence — is the process of collecting and analyzing publicly available data for security, investigative, or journalistic purposes.

You’ve probably used OSINT tools yourself — browsing Twitter for breach chatter, searching pastes, or monitoring news feeds.

---

## The Analyst Bottleneck

> Thousands of alerts.  
> Duplicate news articles.  
> One human analyst.

- "Do we care about this threat?"  
- "Have we seen this before?"  
- "Where did this story originate from?"

Note:

This leads to a real-world problem: the human bottleneck. Even if your collection is excellent, you’re still left with one analyst reading dozens — if not hundreds — of articles and trying to figure out what matters.
Asking questions like 'Have we seen....'
Taranis AI is designed to answer those questions — with the help of AI keeping the human in the loop
While keeping the

---

<h2 style="margin-top: -3em;">Taranis Workflow</h2>

<h5 style="margin-bottom: 2em;">Inspired by Taranis3 & Taranis-NG</h3>

<div style="font-size: 2em;">➝</div>

<div style="display: flex; flex-direction: column; align-items: center;">

<div style="display: flex; gap: 2em; align-items: center; justify-content: center;">

<div style="text-align: center;">
    <img src="assets/checks.svg" alt="Assess" style="height: 2.5em;">
    <div style="font-size: 1.1em; margin-top: 0.2em;">Assess</div>
  </div>

<div style="height: 5em; border-left: 2px dashed #999;"></div>

<div style="text-align: center;">
    <img src="assets/file_search.svg" alt="Analyze" style="height: 2.5em;">
    <div style="font-size: 1.1em; margin-top: 0.2em;">Analyze</div>
  </div>

<div style="height: 5em; border-left: 2px dashed #999;"></div>

<div style="text-align: center;">
    <img src="assets/broadcast.svg" alt="Publish" style="height: 2.5em;">
    <div style="font-size: 1.1em; margin-top: 0.2em;">Publish</div>
  </div>

</div>

<div style="margin-top: 1.5em; text-align: center;">
    <img src="assets/taranis-logo.svg" alt="Taranis" style="height: 4em;">
  </div>
  </div>

<div style="font-size: 2em;">➝</div>

<div class="icon-cloud">
    <img src="assets/html.png" alt="HTML">
    <img src="assets/pdf.svg" alt="PDF">
    <img src="assets/misp.png" alt="MISP">
  </div>

</div>

---

## Features

<div>
    <img src="assets/brain.svg" alt="Named Entity Recognition">
    <h4>Named Entity Recognition</h4>
    <p>Extracts information about people, organizations, locations, etc. from free-form text.</p>
  </div>

<div>
    <img src="assets/warning.svg" alt="Topic Clustering">
    <h4>Topic Clustering</h4>
    <p>Uses topic modelling to find related news items.</p>
  </div>

<div>
    <img src="assets/team.svg" alt="Collaboration">
    <h4>Collaboration</h4>
    <p>Integrates with MISP to streamline threat intelligence collaboration.</p>
  </div>

<div>
    <img src="assets/puzzle-piece.svg" alt="Contextual Enrichment">
    <h4>Contextual Enrichment</h4>
    <p>Leverages NLP for automatic creation of summaries and sentiment analysis or Threat Classification</p>
  </div>

</div>

Note:
Quck overview over the features of Taranis and the challenges involved

---

## Named Entity Recognition
- **Lists and Regex** - CVEs, APT Groups, Hashes
- **NER** - Person, Location, Organziation, Product, Event
</div>

Context and source-specific models (IT security or general news)

Note:
At this screenshot Taranis highlights key entities automatically. CVEs, APTs, people, companies — all annotated.
This dual approach lets us tune for performance and accuracy. Regex when it’s structured. Models when it’s not.
Context and source-specific models (IT security or general news)

---

---

## TOPIC AND STORY CLUSTERING

- Reduces redundancy from multiple sources
- Identifies stories on the same topic with varied titles and styles
- Visualizes topic trends over time

</div>

Note:
- Multiple sources often report the same events in similar ways, increasing analyst workload.
- Taranis AI's story clustering recognizes these as a single story, despite differences, summarizing the main points and relevant publication dates.
- This approach significantly reduces the articles an analyst must review and provides insights into publishing trends, aiding in efficient analysis.

---

## Collaboration

Integrates with MISP to streamline threat intelligence collaboration.

Taranis → MISP → MISP → Taranis

Note:
We also integrate with MISP, so you can take action on insights — export indicators, correlate events, and work with your existing workflows.
This feature is currently still in a beta phase but it allows not only to share to MISP but also to ingest back, so true collobaration between multiple Taranis & MISP instances is possible.

---
<div style="display: flex; justify-content: center; align-items: flex-end; margin: 2em 0; gap: -3em;">
  <img src="assets/misp_taranis.png"     alt="MISP Taranis"   style="height:60vh; position:relative; z-index:3; left:10vw; bottom: 20vh;">
  <img src="assets/misp_taranis_2.png"   alt="MISP Taranis 2" style="height:60vh; position:relative; z-index:2;">
  <img src="assets/misp_taranis_3.png"   alt="MISP Taranis 3" style="height:60vh; position:relative; z-index:1; left:-20vw; bottom: -20vh;">
</div>
---

## Contextual Enrichment

<div style="display: flex; margin-top: 50px">
  <div style="flex: 3 1 400px;" class="arrow-list">
    <ul>
      <li style="height: 3em;">Summarization</li>
      <li style="height: 3em;">Sentiment Analysis</li>
      <li>Threat Classification</li>
    </ul>
  </div>
  <div style="flex: 1 1 300px; display: flex; flex-direction: column; align-items: flex-start;">
    <img src="assets/summarization.png" alt="summary" style="height: 2.5em;">
    <img src="assets/sentiment_analysis.png" alt="sentiment" style="height: 2.5em;">
    <img src="assets/threat_classification.png" alt="threat" style="height: 2.5em;">
  </div>
</div>

Note:
We use multiple lightweight transformers to creation of summaries of articles, sentiment analysis or Thread Classification.
Here our keyfinding was "keeping the human in the loop", so it should be very easy for a human to trigger this, rather than blindly summarizing everything.

---

<div style="display: flex; flex-direction: column; justify-content: center; gap: 2em;">
    <h2 style="font-size: 2.2em; transform: translateY(0.4em); margin: 0;">Source</h2>
    <h2 style="font-size: 2.2em; transform: translateY(-0.4em); margin: 0;">Intelligence</h2>
  </div>
</div>

Note:
Security is about trust and verifiability. Open code means people can inspect, contribute, and adapt the system to their needs.
We are striving for reproduceable builds in all our components, have SBOM and and signed builds.
We could use a lot of GPU models, but users won't be able to use them.

---

## Challenges of AI in OSINT

- Training data scarcity for security-specific tasks
- Domain-specific language in cybersecurity reports
- Resource limits in open-source environments

</div>

Balanced research 🧪  with practical deployment.

Note:

Developing open source software in cyber security / osint field, challenges of developing AI.
For example ressources for ML Model training expensive, but inference also needs more ressources.

---

## Taranis on OpenShift

- 📦 Containerized microservices (Flask, Celery, PostgreSQL)
- 🔁 GitOps-ready deployment
- 🧠 Optional GPU support for model inference
- 🔐 All containers run as non-root, user-only permissions
- 💾 Stateless by design

Note:
Emphasize security-conscious defaults: non-root containers, minimal base images, and persistence kept to a minimum — aligns well with OpenShift's security model. Only PostgreSQL needs persistence

---

## Demonstration

<video controls="" poster="https://taranis.ai/assess_landing_page.png">
<source src="https://taranis.ai/taranis-walkthrough-video.webm" type="video/webm">Your browser does not support the video tag.</video>

---

## Try yourself

```
curl -sL $(curl -s https://api.github.com/repos/taranis-ai/taranis-ai/releases/latest |
 jq -r '.assets[] | select(.name=="compose.yml") | .browser_download_url')\
 -o compose.yml

curl -sL $(curl -s https://api.github.com/repos/taranis-ai/taranis-ai/releases/latest |
 jq -r '.assets[] | select(.name=="env.sample") | .browser_download_url')\
 -o .env

podman-compose up -d
```

Note:
Our default deployment is via a compose file.
There a tagged releases every couple weeks but you can also just pull latest which right now tracks master branch.

---

## Taranis on OpenShift

Note:
Security-conscious defaults: non-root containers, minimal base images, and persistence kept to a minimum — aligns well with OpenShift's security model. Only PostgreSQL needs persistence

---

## Get Involved!

<img src="assets/Taranis.png" style="height: 1em; margin-bottom: -8px;">Taranis AI is open-source and looking for contributors!

- NLP, machine learning, clustering
- New collector integrations
- Real-world feedback and use cases
</div>

<span style="display: inline-flex; align-items: center; gap: 0.5em;">
  <img src="assets/github.svg" alt="" style="height: 1.8em;">
  <a href="https://github.com/taranis-ai/taranis-ai">github.com/taranis-ai/taranis-ai</a>
</span>

Note:
open-source contributors have already improved things — I'm happy to support new ones.
We are currently replacing a lot of the VueJS code with HTMX, investigating switching from python celery to python prefect

---

## Survey

Help us in only 10 minutes

https://survey.taranis.ai/