SentinelOne researchers explore using LLMs to automate extraction of structured intelligence from CTI reports, turning narrative text into machine-readable knowledge graphs. The workflow covers three phases: report sanitization, LLM-based extraction via specialized extractors (Infrastructure, Executables, Playbook), and knowledge graph assembly. Key findings include: LLMs achieve 18x average speed-up over manual analyst processing; extraction quality depends heavily on report formatting, prompt design, data model field naming, and evidence-grading policies. The study evaluates GPT-4.1, GPT-5, GPT-5.2, Claude Sonnet 4.5, and Claude Opus 4.5 out-of-the-box across selective IOC extraction, contextual attribute classification, MITRE ATT&CK mapping, and playbook reconstruction. Trade-offs between accuracy, coverage, and latency are discussed, along with ensemble strategies, abstention handling for ambiguous evidence, and the importance of flexible ground truth labeling for realistic evaluation.
