Agentic Threat Intelligence 101.

A chatbot answers from what it learned in training or what you paste in. An agent goes and looks. Asked whether a CVE in an alert is urgent, an agent can fetch the CVE record, check whether CISA lists it as exploited, read its EPSS score and then answer with a source for each point.

The difference from a SOAR playbook matters too. A playbook runs the same fixed steps every time. An agent chooses its steps, so it can follow a lead the playbook author never planned for. That freedom is also why agents need firm limits.

Every working setup has the same five parts, whatever product or framework you use.

The tool servers are where most of the real work sits. A good tool checks its inputs, returns clean data and states its source. A weak tool hands the model raw pages and hopes for the best.

Human approval is a design choice, not an afterthought. Reading data can run freely. Changing data, such as closing an incident or starting a takedown, should wait for a person.

MCP, the Model Context Protocol, is an open standard that Anthropic introduced in November 2024. It gives AI apps one common way to call outside tools. An MCP server publishes a list of tools, each with a name, a description and the inputs it accepts. The client shows that list to the model, and the model decides which tool to call.

Security vendors now ship their own MCP servers. Some examples:

• VirusTotal publishes an official MCP server for file, URL and infrastructure lookups.
• Google’s mcp-security project covers Google Security Operations, Google Threat Intelligence and Security Command Center.
• Open source community servers connect agents to OpenCTI and MISP.

You can also build your own in an afternoon. Part 1 of our series does exactly that with four free sources. Brandefense has its own MCP server too, so an agent can read your incidents, exposure and threat intelligence with your account’s role.

Agents do best on work that is repetitive, needs several sources and ends in a short written answer. A person still owns the decision.

• Indicator enrichment. Take an IP, domain or file hash from an alert and gather what each source knows about it.
• Alert triage notes. Read an alert, pull the related context and write a short note on what happened and what to check next.
• Report to ATT&CK mapping. Read a threat report and list the MITRE ATT&CK techniques it describes, with the sentence behind each one.
• Feed watching. Check new entries in sources such as the CISA KEV catalog against the products you run.
• Draft reports. Turn a set of findings into a first draft for an analyst to correct.

Each of these saves time only if the output carries its sources. An answer without sources sends the analyst back to do the work again.

Before you let an agent near live alerts, read our checklist on using AI agents in the SOC and threat intelligence safely.

An agent that can call tools can also call them for the wrong reasons. The main risks are well documented, and the OWASP Top 10 for Agentic Applications covers the wider list.

• Prompt injection through data. A feed entry, web page or email can carry hidden instructions. The agent may follow them if tool output is treated as orders instead of data.
• Tool poisoning. A malicious MCP server can hide instructions in its own tool descriptions.
• Too much access. A tool with write rights that it does not need turns one bad decision into real damage.
• Made-up facts. A model can still fill a gap with a confident guess when no tool answers.

The defences are plain engineering:

• Give tools the least access they need.
• Label outside text as untrusted data.
• Ask a person before any change.
• Log every tool call, so you can see how an answer was reached.

This guide is the map for a hands-on series. Every part uses real tools, most of them open source or free (Part 5 needs an Elastic trial licence). Every command was run in our lab, and each part shows the code and files you need to repeat it.

Start with Part 1: its server comes back in Parts 2, 7 and 8. After that, each part stands on its own, so you can pick the one you need:

• Part 1: build a threat intel MCP server in Python
• Part 2: an alert triage agent with the Claude Agent SDK
• Part 3: OpenCTI vs MISP with an AI agent
• Part 4: from a threat report to ATT&CK mappings and Sigma rules
• Part 5: SOC triage with the Elastic MCP server and a Brandefense MCP stand-in
• Part 6: brand and phishing watch with dnstwist and crt.sh
• Part 7: scan your MCP servers with open source scanners
• Part 8: red team your agent with garak, promptfoo and PyRIT

These public pages back the descriptions in this guide.

• Anthropic: Introducing the Model Context Protocol. The November 2024 announcement of MCP as an open standard.
• Model Context Protocol: introduction. The protocol’s own documentation: servers, clients and tools.
• OWASP Top 10 for Agentic Applications for 2026. A peer-reviewed list of the main security risks of AI agents.
• VirusTotal MCP on GitHub. The official VirusTotal MCP server and its setup steps.
• Google mcp-security on GitHub. MCP servers for Google Security Operations, Google Threat Intelligence and Security Command Center.
• CISA Known Exploited Vulnerabilities Catalog. The list of CVEs that CISA has evidence of being exploited in the wild.