Tools, repositories, models and standards

Scalable pseudonymization executed on your own premises. A five-stage pipeline: streaming ingestion of XML, JSON, CSV, PDF, DOCX and XLSX; entity detection combining a NER model with 36 regular expression patterns; replacement by HMAC-SHA256; persistence of the mapping in SQLite; and output preserving the original schema.

In the short course: it is the tool demonstrated in Part 1 of Practice 1. The detection strategy is selectable on the command line and trades coverage for processing cost; the chapter's dataset uses the standalone one. The speed-up is above 535 times over the previous generation, on the same dataset and the same hardware, running on CPU alone: the gain is architectural, not GPU-dependent.

Second generation of the line. It replaces the public hash with HMAC-SHA256 under a secret key set by the operator, extends processing to structured formats with schema preservation, and adds OCR for text embedded in images and PDFs.

In the short course: it explains why the secret key matters. Without it, an adversary reproduces the mapping knowing only the algorithm and the input domain, which makes it trivial to reverse pseudonyms of small spaces such as that of IPv4 addresses.

The first generation, which established the hybrid approach: named entity recognition for what has no fixed syntactic pattern, such as names of people and organizations, and regular expressions for artifacts of determined format, such as IPs, e-mails, URLs and CVE identifiers.

In the short course: it is the anonymization module of the GT-LFI ecosystem, with 97.38% recall over 763 real incidents. It introduced controlled re-identification, with an audit trail.

Intelligence core of the GT-LFI ecosystem, with a Web interface. It offers five capabilities: automatic classification into categories and subcategories; suggestion of containment actions; playbook generation in Markdown and in Ansible; a human-in-the-loop cycle; and lookup of similar incidents.

In the short course: it is the central tool of the hands-on parts of case studies 2 and 3. The intelligence layer is abstracted behind an SDK, which allows switching between models according to the privacy requirement, and the return of human validations is incorporated into the system's knowledge.

Reference implementation of the prompting strategies evaluated in the chapter. Written in Python, it takes pseudonymized tickets, assembles the prompt according to the chosen scenario (with or without taxonomy, with or without iterative heuristics), calls the APIs of the configured models and exports results as CSV, XLSX or JSON.

In the short course: it supports the four-scenario experiment over 194 incidents that shows the gain of combining a structured taxonomy with iterative heuristics. It was later incorporated into AutoClass-LFI.

An evolution of SecLINC. It generalizes the mechanism to five prompt engineering techniques and adds support for local execution via Ollama.

In the short course: it is the basis of the experiments with open-weight models executed on premises, which quantify the accuracy cost of choosing privacy.

Learn From Incidents, a project of RNP's Hackers do Bem program. It integrates four modules into a single cycle: ANON-LFI pseudonymizes; AutoClass-LFI classifies and recommends; the PoP Module submits the result to review by interns and validation by experienced analysts; and the educational platform turns validated incidents into learning tracks, lessons, quizzes and challenges.

In the short course: it is the operational and pedagogical frame of the whole chapter. It is what turned the operational cycle into a pedagogical one, closing the loop between operations and training.

Triage and validation environment of the GT-LFI ecosystem. It gives interns an interface where incidents appear with the labels suggested by the AI for critical review, and gives experienced analysts a consolidated view with the human-AI agreement rate, decision history and prioritization.

In the short course: it is where human validation stops being rhetoric and becomes mechanism. It places validation between classification and playbook generation, and not only at the end, precisely because a mistaken classification produces a correctly generated playbook for the wrong category.

AI-based gamification platform for teaching and learning security. It turns already validated incidents into learning tracks, lessons, quizzes and challenges.

In the short course: it is the link that closes the loop between operations and training. In the evaluation with 35 residents, the mean score between pre-test and post-test rose from 67.9% to 91.7%. The incident classification track was the hardest, with the lowest mean score, which speaks directly to the limits observed in automatic models.

Generator of synthetic security tickets, from the GT-LFI ecosystem.

In the short course: it addresses the second strategy for mitigating data scarcity. The two are complementary, not competing: pseudonymized data can feed models that produce publishable synthetic datasets. The GT-LFI team records the construction of a synthetic incident dataset as a priority for the coming cycles.

Gamified SOC simulation platform for threat hunting training and incident response education, developed in partnership with RNP. Its architecture is characterized as a SIEM-type environment, which reproduces an analyst's working conditions under controlled conditions.

In the short course: it complements the GT-LFI ecosystem by offering the simulation environment that the training tracks presuppose.

It holds the five Python notebooks, which cover the three case studies and chain together through the outputs of each practice; the set of synthetic tickets used in the demonstrations; the reference prompts; five standard operating procedures in dados/pops/; and the installation instructions.

In the short course: it is the executable complement to the chapter. The notebooks are self-contained, do not depend on access to the group's internal tools and run without a GPU and without API credentials. The code is under the MIT license; the texts, synthetic data and teaching material, under CC BY 4.0.

The full text of Chapter 1, in Portuguese, across 50 pages: the normative foundations, the literature review organized by application category, the three case studies and the conclusions.

In the short course: it is the source of everything this site summarizes. The chapter explains the why; the repository shows the how, in executable form. The version available here is the authors' own, preceding official publication by the SBC.

Data protection and de-identification SDK, with orchestration of personal information recognizers over free text.

In the short course: it is used by AnonShield's presidio strategy, which maximizes recall at the cost of false positives coming from recognizers irrelevant to the security domain. Precision of 71.9% with the same 96.4% recall as the other strategies, which is defensible when over-anonymization is acceptable.

Anonymization of tabular data with formal guarantees: k-anonymity, l-diversity and t-closeness. It originates in the biomedical domain.

In the short course: it appears as a counterpoint. Tools like this presuppose tabular data and detection already done, and therefore do not attack the operational problem of free-text reports.

Statistical disclosure control for microdata, originating in the statistical domain.

In the short course: the same counterpoint as ARX. It is a mature tool for structured tabular data, not for narrative reports mixed with technical artifacts.

Anonymization of IP addresses preserving prefix structure, which keeps subnet-level analysis possible after treatment.

In the short course: it is elegant and solves well what it sets out to do, but it covers a single entity type. It was used by Jesus Filho and colleagues in anonymizing the dataset labeled with the CERT.br taxonomy.

Lightweight commercial model, accessed through an API, with a free tier on Google AI Studio that is sufficient for the short course activities.

In the short course: it is the model that produced the results reported in case studies 2 and 3, and the one Practice 2 calls in real time. The exact identifier is recorded on purpose: commercial providers update endpoints without notice, and reproducing the numbers depends on that information.

Packaging and management layer for open-weight models running locally, which substantially lowers the barrier to entry.

In the short course: it is the local provider of Practice 3 and the basis of the experiments with open models that quantify the cost of privacy. It is the path that makes that argument tangible: with it, the data never leaves the participant's machine.

Library and associated repository that consolidated the ecosystem in which pre-trained models are distributed with open weights and can be executed locally.

In the short course: it loads AnonShield's NER model. The Practice 1 notebook degrades gracefully: if the library is unavailable, a simplified lexical recognizer takes over, and the lesson about coverage remains observable.

Multilingual named entity recognition model, which recognizes person, organization and location.

In the short course: it is AnonShield's default NER model, used without fine-tuning. Being multilingual matters, because reports from Brazilian academic CSIRTs mix Portuguese and English, sometimes within the same ticket.

Entity recognition model trained on roughly 503 thousand annotated threat intelligence excerpts, able to recognize 22 entity types specific to cybersecurity.

In the short course: it is the domain alternative to the default multilingual model. It addresses the gap noted in the chapter: generic NLP frameworks do not ship recognizers for the technical vocabulary of security.

Sentence embedding model from the Sentence-BERT family, used to measure semantic similarity between passages of text.

In the short course: it supports the semantic comparison between the model's answer and the human label, which is needed when the model answers in free text. It introduces a dependency that has to be declared, because the choice of embedding model changes the numbers.

Model with 8 billion parameters and continued pre-training adapted to the security domain, published by Cisco's Foundation AI.

In the short course: it represents the third route to narrowing the gap between local and commercial models without giving up local execution. Continued training over specialized corpora improves typical SOC tasks, including alert triage and enrichment.

Among 21 models from 1 to 20 billion parameters evaluated, three stood out in the 62% to 70% precision range across both hardware platforms tested: deepseek-r1:14b, phi3:14b and qwen3:4b. Models from 1B to 1.8B stayed below 20%.

In the short course: they delimit the practical hardware recommendation. The determining factors are the number of parameters and GPU capacity, not temperature: whoever intends to run classification locally should invest in video memory rather than spend time calibrating temperature.

Open source SOAR orchestrator, with a visual flow editor and a broad library of connectors.

In the short course: it is the main option cited in the survey of open SOAR platforms and the integration basis of AI4SOAR, used to demonstrate automatic playbook selection.

Case management platform for incident response, with strong integration to the Cortex analysis engine.

In the short course: it appears in the survey of open platforms as the option oriented to case management rather than to flow orchestration.

Analysis engine that accompanies TheHive, running analyzers and response actions over the observables of a case.

In the short course: it is the component that performs enrichment, the step that precedes deciding which playbook to turn to.

It combines SIEM functions, endpoint detection and active response in a single open source platform.

In the short course: it corresponds to the visibility and behavioral detection layers, the first two of the three maturity levels proposed for building a SOC from open components.

Instead of generating a new playbook, it selects from the existing repository the one best suited to the incoming alert, using similarity learning, with integration to Shuffle.

In the short course: it represents the path of retrieving rather than generating. The security advantage tends to be underestimated: the retrieved procedure has already been approved, which eliminates the entire category of risks associated with hallucination. The limitation is coverage, since novel alerts have no counterpart.

Revision 3 brought a relevant shift of perspective: rather than treating incident response as a self-contained process with its own phases, it presents it as a community profile of NIST CSF 2.0. Preparation and learning stop being steps of a closed cycle and become continuous risk management activities.

In the short course: the reference taxonomy adopted here derives from it, with twelve functional categories, used consistently across case studies 1 and 2.

It organizes security management into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

In the short course: it is the structure onto which the chapter maps, function by function, where AI can help and what remains under human decision. Govern is the function that decides how much autonomy to delegate to an automated system.

It organizes risk management for AI systems into four functions: Govern, Map, Measure and Manage.

In the short course: it provides the governance principles applicable to a SOC context, which is where the abstract discussion about autonomy turns into a decision per function.

It addresses the identification and management of bias in artificial intelligence.

In the short course: it is the reference that emphasizes the human in the loop as a central practice for mitigating AI risks, and it underpins the design of the PoP Module.

It organizes the work of a response team into service areas: security event management, incident management and vulnerability management, among others. It is deliberately tool-agnostic: it describes what the team does, not how.

In the short course: it provides the vocabulary that separates CSIRT from SOC, a distinction often confused. Both consume the same input, textual reports of adverse events, and face the same triage bottleneck.

OASIS standard for representing playbooks in JSON, with an explicit flow structure: sequential, conditional, parallel and decision steps, plus target agents and commands. Its purpose is exchange between organizations and orchestration on SOAR platforms.

In the short course: it is the format required in the output of Practice 3, and what makes automatic validation possible. Syntactic validation checks conformance to the schema; semantic validation checks whether the referenced steps exist, whether the graph is reachable and free of undue cycles, and whether no command uses a tool outside the authorized list.

It catalogs adversary tactics and techniques observed in real incidents, and is the reference vocabulary for threat intelligence.

In the short course: it serves as context in playbook generation, but the chapter makes an important caveat: ATT&CK describes how an adversary acts, not what kind of incident occurred, and therefore does not replace a classification taxonomy.

Incident classification taxonomy designed to harmonize communication among European CSIRTs.

In the short course: it is part of the landscape of vocabularies in use, alongside MITRE ATT&CK, the CERT.br taxonomy and the NIST functional categories.

Compact set of operational categories adopted in national notifications. In the subset used in the chapter there are six categories: DoS, fraud, intrusion, scanning, web and others.

In the short course: it is used as a contrast to the twelve NIST categories, which allows discussing a point rarely made explicit: the choice of vocabulary affects measured performance as much as the choice of model, and reporting accuracy without declaring the taxonomy makes the number incomparable.

Executable format for playbooks, in which each step becomes an idempotent task applicable to the infrastructure.

In the short course: it is one of the three playbook representations used. Idempotence is decisive, because re-running the procedure does not duplicate effects, which matters when the state of the environment is uncertain. The trade-off is that an executable playbook generated by a model is, potentially, an unsafe action vector.

Law no. 13,709 of 14 August 2018, the Brazilian General Data Protection Law.

In the short course: it defines the legal regime of the whole material. The consequence has to be stated without ambiguity: because reversal is possible for whoever holds the key and the mapping, the pseudonymized datum remains personal data. Teams that treat pseudonymization as equivalent to anonymization take on a compliance risk they do not perceive.

Historical series of incidents reported to CERT.br, broken down by incident type and by year.

In the short course: it is the source of the number that opens the chapter, 516,556 notifications in 2024 alone, equivalent to an average of 1,411 per day.

Browsing of published vulnerabilities, organized by date.

In the short course: it supports the second pressure indicator: CVEs published per year went from about 7,928 in 2014 to 40,287 in 2024, reached 48,448 in 2025 and have a median forecast of around 59,400 for 2026.