OpenCTI AI Engineer for RAG and Agent pipelines

@Web1devloper

The main challenge is not simply adding an LLM to OpenCTI; it is turning noisy, evolving threat-intelligence data into explainable signals that analysts can trust. Anomaly detection, forecasting, alert delivery, and RAG enrichment need to share consistent entity and event handling while remaining independently testable and deployable. For the initial milestone, I would keep the delivery focused on one complete vertical path: ingest OpenCTI data through a Python service or connector, generate anomaly and trend outputs, enrich relevant findings through retrieval, and expose actionable alerts with evidence and confidence metadata. I’d establish a measurable validation flow around the existing dataset, including false-positive tracking and a four-week back-test, rather than treating model accuracy as a subjective result. Embeddings, chunking, metadata filters, and prompts would be tuned for security intelligence so retrieved context supports the forecast instead of adding irrelevant text. AWS components would be selected around workload behavior: event-driven processing where appropriate, durable storage for features and results, and isolated services for model/RAG execution. Infrastructure-as-code would define the full environment with clean teardown. The implementation would include unit and integration tests, coverage reporting, CI checks, structured logging, retries, and clear handling for missing or malformed intelligence data. If a React monitoring surface is part of the integration, it can consume a typed API while keeping server state separate from local UI state and preserving clear loading, error, and empty states. I would also provide a concise runbook covering configuration, deployment, model evaluation, connector operation, alert troubleshooting, and extension points, with clean Git commits and deployment scripts suitable for team ownership. Which OpenCTI version, existing dataset format, and AWS/IaC repository or deployment conventions should the implementation target?

@mohjib092

Hi there , I am python hub , I have read the project description , I can provide you quality work on time , Can you please come to the chat box so se we can easily discuss in details, Thank You ,

@huonghy89

Hi, I hope you are doing well. Very happy to bid your project because my skills are fitted in your project. I have strong Python and AI/ML engineering experience building production-grade microservices, anomaly-detection pipelines, forecasting systems, RAG/agent workflows, vector-search solutions, and cloud-native applications on AWS. I am comfortable with threat-intelligence workflows, OpenCTI-style connectors/APIs, embeddings, prompt engineering, automated testing, CI/CD, and infrastructure-as-code. I will build Python OpenCTI connectors/microservices for real-time anomaly detection, alerting, and emerging-threat forecasting, then validate and tune them against your historical dataset to meet measurable false-positive and back-test targets. I will implement a security-focused RAG pipeline that enriches OpenCTI intelligence with approved external sources while maintaining traceability and reliable retrieval. I will also deliver ≥90% unit-test coverage, CI/CD and one-command AWS infrastructure deployment/teardown using appropriate Lambda/ECS/EKS, S3 and database services, together with a concise technical runbook for maintenance and future extension. If you send the message, we can discuss the project more. Thanks.

@Abror86

Hi-Abror Here From Uzbekistan. "Build OpenCTI AI RAG Agent Pipelines" - I can develop OpenCTI AI capabilities using Python, RAG, predictive analytics, and scalable AWS infrastructure. I can integrate OpenCTI connectors, Python anomaly models, vector retrieval, embeddings, and forecasting workflows across AWS services with secure production-ready interfaces and scalable robust pipelines. I will implement RAG enrichment, automated testing, CI/CD infrastructure, deployment scripts, monitoring, and concise runbooks meeting acceptance criteria for reproducible deployments and long-term maintenance workflows. Could you share your existing OpenCTI version and current threat-intelligence dataset for model development? Could you please clarify the following questions to help me better understand the project? : 1. What vector database and embedding model are currently preferred? 2. How is your existing AWS infrastructure managed through IaC? Looking forward toworking with you.

@Ritesh11gupta

Building RAG pipelines inside OpenCTI takes someone who already knows the API quirks. Since you need Python for those agent workflows, how are you currently handling the vector storage?

@NEHABHAT92

With almost a decade of experience in web and mobile development, focusing on both project feasibility and delivering top-notch results, I offer an ideal blend of skills for your OpenCTI project. My proficiency in Python and React.js, combined with my thorough understanding of various AWS services (Lambda, ECS/EKS, S3, DynamoDB or RDS) essential for this project, ensures a solid foundation for success. My core expertise lies in designing complex APIs and implementing them using infrastructure-as-code principles, which aligns perfectly with your need for building Python micro-services or OpenCTI connectors.

@ibrahimsoft004

Hello, I’m an experienced Python engineer with expertise in AI/ML, RAG pipelines, microservices, and AWS, and I can help build the predictive threat-intelligence capabilities you need around OpenCTI. I can develop OpenCTI connectors/Python services for anomaly detection, real-time alerting, and threat-trend forecasting, while integrating RAG with embeddings, vector stores, external intelligence sources, and security-focused prompt engineering. For AWS, I’m comfortable working with Lambda, ECS/EKS, S3, DynamoDB/RDS, Docker, and Infrastructure-as-Code to deliver reproducible deployments. I’ll also implement automated testing with ≥90% coverage, CI/CD, four-week back-testing, monitoring, and a concise technical runbook. I’ll focus closely on your acceptance criteria, especially reducing false positives below 5% and ensuring reliable, measurable forecasting results. I’m ready to start quickly and can share relevant AI/security projects and architecture examples.

@aprkdream

Hi, You’re looking to turn OpenCTI’s threat intel into proactive alerts and predictive insights, so the platform can surface anomalies and forecast new attack vectors before they hit. In my 11‑year career I built a predictive‑analytics layer for Shrigoda CRM that surfaced lead conversion anomalies and triggered real‑time notifications. I used Python, FastAPI, PostgreSQL, and vector embeddings to power the dashboard and alert logic. Execution scope - Design micro‑services in Python that consume OpenCTI events, run anomaly detection, and emit alerts via SNS/SQS. - Build a RAG pipeline: ingest threat intel, embed with OpenAI embeddings, store in DynamoDB/ElasticVector, and craft prompts for contextual inference. - Wire the services on AWS using IaC (CloudFormation/Terraform), deploying to ECS/EKS and Lambda where appropriate. - Implement real‑time alerting and a forecast model that feeds a dashboard built in React, respecting role‑based visibility. - Write unit and integration tests, and set up CI/CD pipelines with GitHub Actions and CodePipeline. - Ensure data consistency, low latency, and secure access through IAM roles and VPC endpoints. The first step is to understand the existing OpenCTI event schema and the preferred vector store. Could you share that detail? Let’s keep the scope tight and deliver a ready‑to‑run stack that can be extended later. Best Regards, Anil Prajapati

@ronakkataria1

One thing in your acceptance criteria worth settling before anyone quotes.. a 5% false positive rate is not really a constraint on threat intel. If OpenCTI is ingesting even 50k observables a day, 5% is 2,500 alerts a day and the SOC drowns. The base rate of genuine anomalies is tiny, so FPR is the wrong denominator. What works is fixing an alert budget, say 30 a day, optimising precision at that budget, and reporting FPR as a side effect. Happy to hold your number, I just want it defined against something an analyst can live with. Second thing.. OpenCTI merges entities on deterministic standard_id, so embedding entities straight into a vector store leaves orphaned duplicates after every merge, and you lose the edges, which is where most of the signal actually sits. I embed at report and observable-context level, key on standard_id, and use graph relationships as pre-filters before retrieval instead of flattening them into text. Build wise: pycti connectors on the RabbitMQ queue rather than polling GraphQL, which will rate limit you. Detection and forecasting as separate services on ECS Fargate, Terraform for the stack, S3 for feature snapshots, model artefacts versioned so a back test is reproducible. Tests and CI to your 90% line, runbook written for your team. Question.. roughly how many observables a day, and how many labelled true incidents sit inside the four week back test window? Ronak

@abhilashr53

I can deliver 'OpenCTI AI Engineer for RAG and Agent pipelines ' end to end — clean architecture, tests, and deployment. I'll start with a short plan, share progress daily, and hand over production-ready code. Could you confirm your timeline and must-have features so I can lock the scope?

@ankits0192

Hello, Your goal is to extend OpenCTI with production-ready AI capabilities—not just a basic RAG demo, but agent-based pipelines for anomaly detection, real-time threat alerts, and predictive intelligence on AWS. I can help build this with Python and a modular architecture covering: • OpenCTI connectors/microservices for threat-intel processing • RAG pipelines with embeddings, vector search and external intelligence • Anomaly detection and four-week trend forecasting • AWS deployment using Lambda, ECS/EKS, S3 and RDS/DynamoDB as appropriate • Infrastructure-as-code and automated CI/CD • Unit/integration testing with ≥90% coverage • Technical runbook for maintenance and future extensions I have strong experience with Python, AI/ML, RAG, agentic AI, APIs, AWS and React, with emphasis on scalable and maintainable production systems. I’ll also design the pipeline so model performance and false positives can be measured against your existing dataset rather than relying on assumptions. Could you share the existing OpenCTI deployment and a sample of the threat-intelligence dataset so I can assess the best RAG and anomaly-detection architecture? Best regards

@ziedb4

Hello, Python, RAG pipelines and agent systems are my core work. Two things I'd want to address up front, because they're where this project succeeds or fails. The <5% false-positive target. That's achievable, but it depends on what "outlier" means in your dataset — a novel IOC is an anomaly in the statistical sense and entirely normal in the operational sense. I'd start with an unsupervised baseline (isolation forest or similar) on your existing data, measure where the errors actually fall, then tune. Ensembling a statistical detector with a sequence model usually gets there; committing to the number before seeing the data would be guessing. RAG on threat intel needs the retrieval layer scoped tightly — embeddings over CVE, MITRE ATT&CK and your feeds, with metadata filters on time and source so enrichment doesn't pull in stale or irrelevant context. I'd use pgvector on RDS rather than a separate vector service; one fewer thing for your team to maintain. Stack: Python micro-services as OpenCTI connectors, deployed via ECS. Terraform for the infrastructure — I'd note that Terraform is the area where I'd be building on solid but not deep experience; everything else here is well-trodden ground for me. Happy to scope milestones once I know the data volume.

@abdullahrafiq0x

I can build the complete OpenCTI intelligence layer focused on detecting anomalies, identifying emerging threat patterns, and generating real-time alerts. I’ll develop the core Python services, implement the RAG pipeline to enrich threat intelligence from relevant sources, and integrate the solution with OpenCTI and the required infrastructure. I’ll also handle AWS deployment, automated testing, monitoring, and infrastructure-as-code so the system is reliable and maintainable. My approach will be modular, allowing your team to easily extend detection rules, intelligence sources, and AI capabilities later. I’ll provide clear documentation and a deployment/runbook guide so the project can be operated confidently after handover. I’m confident I can deliver a production-ready solution while keeping the architecture clean, scalable, and easy to maintain.

@inventiverhino

Anomaly detection on threat-intel data with a hard <5% false-positive target is the part that decides this project, and it's where most RAG-first bids will go quiet. I've built that shape. Isolation Forest anomaly detection over 178M+ hourly rows, 84 model training runs a night across 14 organisations, on AWS after I cut that pipeline from 6-10 hours to 45-60 minutes with Step Functions. Python, ECS, S3, RDS, infrastructure as code. On the RAG half I build the evaluation harness before the features. Retrieval graded on hit@k and MRR, groundedness measured twice by independent methods, thresholds grid-searched against hand labels rather than guessed. I audited my own RAG system once and published its 52.8% hallucination rate. Your acceptance criteria are numeric, which is how I'd want it written. Straight answer on OpenCTI: I have not worked inside it. I've written ingestion connectors against STIX-shaped graph data, and a connector is Python plus an API contract, so I'd expect days of ramp rather than weeks. Better you hear that now. First thing I'd hand you is the anomaly module running against your existing dataset with a real false-positive number on the board, before any forecasting work starts. What does your labelled dataset look like, and how far back does the history go? Sandip 15+ years engineering · ex-Mastercard-tier Principal Data Engineer · AWS Certified

@HenreM1

I recently helped a client turn their idea into a professional, user-friendly solution that improved their workflow and gave them a smoother overall experience. I can help you achieve the same by creating a reliable solution focused on your goals, functionality, and user experience. With extensive experience in Python and OpenCTI, I specialize in embedding advanced AI capabilities, including anomaly detection and trend forecasting. My strong background in AWS services, such as Lambda, ECS, and DynamoDB, ensures that I can wire everything together seamlessly with infrastructure-as-code. I understand the importance of keeping everything clean, responsive, and easy to use while ensuring the technical side works properly. I will deliver Python micro-services, a robust RAG pipeline, automated tests, and a brief technical runbook for your team. I would be happy to discuss your project and explore the best way to bring your idea to life. Regards, HenreM1

@devs414

Hi, We’re a development team working with Python, LLM integrations, RAG systems, agent pipelines, backend architecture, and production deployments. Your OpenCTI project is close to the kind of work we handle: connecting AI components to existing systems rather than building an isolated chatbot around them. We can work on the RAG pipeline, agent logic, OpenCTI integration, predictive analytics layer, and the infrastructure needed to run it reliably. We’re comfortable with Python, APIs, databases, AWS, CI/CD, React, LLM/RAG architecture, and technical documentation. We can also handle the surrounding backend and deployment work, so you won’t need separate developers for each part of the integration. Before starting, we’d like to review your current OpenCTI setup and what data and workflows the agents will operate on. From there we can define the architecture, milestones, and what should be implemented first. Ready to discuss the technical details and start.

@adarshk174

I am an experienced Python and AI engineer with hands-on expertise building custom OpenCTI connectors and agentic RAG workflows for threat intelligence. I can deliver your predictive analytics solution end-to-end on AWS while meeting every acceptance criterion: Anomaly Detection & OpenCTI Connectors: Develop containerized Python micro-services on AWS ECS/Lambda that ingest STIX2/threat feeds, using calibrated isolation forest and statistical models to maintain a <5% false-positive rate. Agentic RAG Pipeline: Implement an agent-based retrieval architecture with vector embeddings (pgvector/OpenSearch) to enrich threat alerts against external intelligence sources. Back-Testing & Trend Forecasting: Build time-series forecasting modules validated across your 4-week historical dataset to ensure verifiable predictive accuracy. AWS IaC & CI/CD: Write clean Terraform/CloudFormation templates for single-command spin-up/tear-down with zero orphaned resources, backed by GitHub Actions achieving ≥90% unit test coverage. Documentation: Deliver a practical technical runbook covering connector setup, model retraining, and maintenance.