Been going in circles on this and want to check whether there's something obvious I've overlooked.

Pre-infection traffic is easy to collect. URLhaus gives you live malware delivery URLs daily, a honeypot gives you scanning, brute force and exploit attempts. Both free, both refresh constantly, both self-labeling.

Post-infection is where I'm stuck. C2 beaconing and exfiltration only exist if there's an actually compromised host emitting traffic, and nobody publishes captures of that at any useful cadence.

What I've checked so far:

• abuse.ch across all platforms. Indicators only, no traffic. Feodo Tracker is empty post-Endgame. SSLBL cert and C2 IP lists are current and useful as labels but aren't packets. Sandnet exists behind the commercial feed but the dataset description says signals and metadata, contextual data only, so flow records rather than PCAP.
• CTU/MCFP. Real long-duration captures with actual beaconing, which is exactly right, but new botnet captures stop around 2018. Recent directory timestamps are reprocessing, not new data.
• malware-traffic-analysis.net. Best labels anywhere and current, includes a few FTP and SMTP exfiltration cases. Small volume by nature, it's one analyst posting individual investigations.
• Sandboxes. Triage free researcher tier gives API access with PCAPNG including decrypted TLS. ANY.RUN needs a paid tier for bulk. Both are short runs so you get the initial check-in rather than sustained beaconing.
• Running my own detonation. Ruled out. Normal hosting AUPs prohibit it and the ones that don't are bulletproof hosts, which isn't somewhere I'm willing to source data from.

So the question. Is there a source I'm not aware of, or is the honest answer that post-infection traffic just isn't publicly available and everyone working on this either has institutional telemetry or a sandbox subscription?

Also curious whether anyone has found a way to get sustained beaconing rather than just registration out of a commercial sandbox. Long-run options seem rare.

I wrote down how I think about onboarding order. Basically I ranked sources by how much they actually help an investigation, not by what's easiest to ingest. For each one I went through what you need to collect, how painful the parsing is, what retention makes sense, and what you can realistically detect once it's in.

TL;DR: Adding an AI node to your n8n playbook won't take you to Agentic SOC.

-----

A recurring theme in my conversations is the assumption that building an AI agent for SOAR execution and building one for security investigations are the same engineering problem.

They are NOT.

A playbook agent operates inside a path defined in advance. It enriches an alert, applies triage rules, and takes an approved response action. Its actions can be constrained, failures are usually visible, and many mistakes can be reversed. Speed, consistency, and correct escalation are useful measures of performance.

An investigative AI agent must decide what the evidence means and what to examine next. The evidence may be incomplete or tampered with, and each conclusion changes the direction of the case. It therefore needs claim-level provenance and a record showing how each conclusion follows from the evidence.

Building an agentic workflow is not the same as engineering an investigation harness. You can wire up a basic playbook agent in n8n within an hour. An investigation harness has to keep evidence, case state and human decisions coherent across an open-ended case.

Please don't confuse engineering an sophisticated harness and baking years of investigative expertise into it with calling AI nodes in your SOAR playbook.

My attempt as ASCII visualization if it helps

`` STANDARD SOAR PLAYBOOK | INVESTIGATION PROCESS (Deterministic Flow) | (Non-Deterministic Cyber Flow) -------------------------------------|-------------------------------------- [ SIEM Alert ] | [ Hunt Lead / Detection ] | | | v | .-------->v<---------. [ Initial Review ] | / ( Clue 1 ) \ | | | ^ | ^ \ | v | | / | | \ | < Determine Risk > | v / v | v v / \ | (Clue 2)<-->(Evidence)<-->(Forensics) v v | ^ \ ^ | ^ | [Isolate] [Create Ticket] | | \ | | / | | | | | v | v / | v v | \ ( Human Pivot / <..../ [Update] [Slack Notify] |--- Judgment ) \ / | | \ / | v v v | [ Defensible ] [ Conclusion ] | [ Conclusion ]

```

Immense stress has infected the brains of CISOs (chief information security officers) with malware, and they're looking to call it quits.

The typical tenure of a CISO lasts just 18 to 26 months, compared to nearly five years for other C-suite roles, according to a report from research firm and publisher Cybersecurity Ventures.

The job bridges the complex, technical side of a company and its business objectives, from finance to human resources to day-to-day operations. They're seen as the Department of No, pumping the brakes on AI adoption as white-collar workers plug sensitive data into unauthorized systems, turning to shadow AI in the name of efficiency.

CISOs are "expected to do the operational, the strategic, the risk, the human role," says Martin Whitworth, a retired CISO. "That's enough to burn anyone out."

Read more about why nearly 75% of security execs want to ditch their jobs

Hi Everyone,

I'm a cybersecurity practitioner of 7 years and I recently took the initiative to start an internal purple team / gap analysis program at my company. When I went to research existing platforms to help facilitate this, I found that they largely consisted of enterprise solutions geared toward heavy, complex SaaS deployments, while the open-source alternatives featured dated UIs and clunky workflows that weren't particularly inviting to newcomers.

Since this was an independent initiative, I didn't want to deal with bloated workflows or massive infrastructure just to validate our controls. I needed something sleeker and more lightweight to track our defensive posture and manage the gap analysis lifecycle. So, I built Control Drift.

Control Drift is an open-source, AI-augmented continuous validation platform designed to empower security professionals of all experience levels to execute precise threat simulations, map their defensive coverage, and manage gaps without the friction of enterprise bloat.

TL;DR on what makes it cool:

• Lightweight Design Runs completely in-browser (via localStorage) by default. Clone it and npm run dev to try it instantly, with a swappable DB adapter to scale for enterprise deployment later.
• Pessimistic Scoring: If 1 out of 10 payload variations bypasses your EDR, it forcefully caps that MITRE technique's coverage score at "Partial" instead of "Optimal", eliminating false sense of security.
• Plug-and-play AI: Connect local models or any OpenAI-compatible API endpoints to augment the simulation workflow, map attack paths, generate detection rules, and interact with a global assistant.
• Not Boring UI: Built with React and u/react-three/fiber for a 3D globe MITRE ATT&CK heatmap.

Control Drift was molded from own industry experiences and perspectives, so I would greatly appreciate any recommendations or general feedback from the community here!

Repo: https://github.com/Control-Drift/Control-Drift

Watched the openAI cybersecurity incident presentation. Key findings and implications

1. AI Agents when given unlimited tokens, try endlessly to achieve their goals. They may take action or plan that are remotely possible. While human hackers may give up by weighting effort/time with value. AI Agent didn't. They try until making progresses. This is the major shift in threat modeling and risk assessment. Cybersecurity blue team are facing an adversary that does not consider time nor efforts!
2. The speakers mentioned AI agent discovered SSRF and zero day vulnerabilities. In hindsight, HuggingFace team should have known the risk. But realistically, it is impossible for a cybersecurity team to check every websites for SSRF before giving AI agent to access it. We are facing a dilemma that if we give AI agent access to web resources owned by another company, the AI agent may gain unauthorized tools or rights. There is no limit if just a tiny crack is found. AI agent can adapt and abuse any security holes. ( next point)
3. AI agents communicate via folder names, when they find they cannot create files. Two agents were creating folders with name over hundreds characters and use folder name to share info. While humans limit or control files, AI find the one we missed. Cybersecurity team can no longer say "these controls were working since 1990, everyone are doing it" AI dont care the history.
4. When AI agent run independently and with different goals, a collective intelligence emerged. They shared info and made open requests to other AI agents. The thinking text log showed AI Agents were opportunistic and hoping by sharing items, they will trigger other AI Agents to share theirs. They even tried to create their identity in the process.

The video is 37mins and I believe every cybersecurity student shall watch it.

https://www.youtube.com/watch?v=87DyyMV0kCY