Using LLM for Threat Intelligence

Threat intelligence teams routinely process unstructured reports, indicator of compromise (IOC) lists, and adversary technique descriptions that span thousands of tokens. Large language models can automate extraction, summarization, and MITRE ATT&CK mapping, but token-based inference costs scale directly with input length. For security workflows that require long-context ingestion of PDF bulletins, multi-turn agentic analysis, or batch processing of historic feeds, this pricing model creates a ceiling that is hard to justify. Oxlo.ai offers a developer-first inference platform with flat per-request pricing. Cost does not scale with prompt length, which makes it a strong fit for threat intelligence pipelines that ingest long documents or run autonomous analysis loops. With 45+ models across seven categories and full OpenAI SDK compatibility, Oxlo.ai drops into existing security tooling without refactoring.

Why LLMs Fit Threat Intelligence Workflows

Modern threat intelligence is a long-context problem. A single incident report from a vendor can contain technical narratives, obfuscated code snippets, and multi-language context. Mapping these to frameworks like MITRE ATT&CK requires reasoning over the full document, not just the first page.

LLMs help in three concrete ways:

• IOC extraction: Parsing free-text blogs and PDFs for IPs, domains, file hashes, and registry keys.
• TTP summarization: Identifying adversary tactics and translating raw incident data into structured technique IDs.
• Cross-source fusion: Comparing multiple reports to find shared infrastructure or actor behavior.

These tasks benefit from reasoning models. On Oxlo.ai, DeepSeek R1 671B MoE handles deep reasoning and complex coding contexts, while Kimi K2.6 provides advanced reasoning, agentic coding, and vision capabilities across a 131K context window. Qwen 3 32B adds multilingual coverage for non-English threat reports, and GLM 5 supports long-horizon agentic tasks when you need sustained analysis across many documents.

An IOC Extraction Pipeline with Structured Output

The fastest way to integrate an LLM into a threat intel stack is to treat the model as a structured extraction engine. Oxlo.ai supports JSON mode and function calling, so you can enforce schemas for IOCs without post-processing regex.

The following Python example uses the OpenAI SDK pointed at Oxlo.ai. It assumes you have a threat bulletin in report_text and want to extract a list of indicators with types and confidence scores.

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.oxlo.ai/v1",
    api_key=os.getenv("OXLO_API_KEY")
)

report_text = """
... paste a long threat report here ...
"""

response = client.chat.completions.create(
    model="llama-3.3-70b",  # or deepseek-r1-671b-moe for reasoning-heavy reports
    messages=[
        {
            "role": "system",
            "content": (
                "You are a threat intelligence analyst. Extract all IOCs from the report. "
                "Return valid JSON with keys: iocs (list), each containing type, value, and confidence."
            )
        },
        {
            "role": "user",
            "content": report_text
        }
    ],
    response_format={"type": "json_object"},
    temperature=0.1
)

print(response.choices[0].message.content)

Because Oxlo.ai uses request-based pricing, the cost of this call is the same whether report_text is 2,000 tokens or 20,000 tokens. For teams processing daily feeds, this predictability removes the need to truncate or chunk documents solely to control spend.

Mapping TTPs to MITRE ATT&CK

Extraction is only the first step. The second is attribution to known tactics and techniques. Reasoning models excel here because they must infer the intent behind an observed behavior and match it to a standardized definition.

You can use DeepSeek R1 671B MoE or Kimi K2 Thinking on Oxlo.ai for chain-of-thought reasoning before producing the final structured output. A simple prompt pattern is to ask the model to think step by step, identify behaviors, then map each behavior to a MITRE technique ID and sub-technique ID.

response = client.chat.completions.create(
    model="deepseek-r1-671b-moe",
    messages=[
        {
            "role": "system",
            "content": (
                "Analyze the incident description. For each adversary behavior, "
                "explain your reasoning, then map it to the most specific MITRE ATT&CK technique ID. "
                "Return JSON with keys: behaviors, reasoning, technique_id, technique_name."
            )
        },
        {
            "role": "user",
            "content": incident_description
        }
    ],
    response_format={"type": "json_object"}
)

If your pipeline processes images of attack flow diagrams or screenshots of malicious infrastructure, Kimi K2.6 and Gemma 3 27B on Oxlo.ai support vision inputs, letting you pass base64-encoded images alongside text for multimodal analysis.

Cost Predictability at Scale

Threat intelligence rarely operates on short prompts. A single PDF report, when converted to text, can exceed 16K tokens. When you multiply that by hundreds of daily reports, token-based billing becomes volatile.

Oxlo.ai differentiates itself with flat per-request pricing. Unlike token-based providers such as Together AI, Fireworks AI, OpenRouter, Replicate, or Anyscale, cost does not scale with input length. For long-context and agentic workloads, request-based pricing on Oxlo.ai can be 10-100x cheaper than token-based alternatives. You do not need to pre-chunk documents or strip formatting to save tokens.

The platform also offers no cold starts on popular models, which matters when you are running streaming enrichment pipelines that