Automation and Orchestration in Cyber Threat Intelligence (CTI): A Survey

Cyber Threat Intelligence (CTI) has become an essential part of security operations with the sudden rise in cyber threats. To manage the collection, enrichment, correlation, and response workflows for CTI, several automation and orchestration technologies, such as SOAR (Security Orchestration, Automation, and Response) platforms and CTI pipelines are utilised. This survey reviews open-source as well as commercial SOAR platforms e.g. Splunk SOAR, Cortex XSOAR, IBM QRadar SOAR, TheHive, Shuffle) as well as frameworks used in CTI such as MISP and OpenCTI, comparing their features, integration capabilities, and limitations. Research done in the last 5-7 years on automated CTI processing, including methods for improving and linking data, AI and machine learning-driven analysis, and full-system architectures, is highlighted in this paper. Standard formats like STIX/TAXII and related sharing protocols help ensure different systems can communicate effectively. A comparison table shows the difference between major platforms based on key aspects such as data formats, integrations, response capabilities, and AI/ML support. Common challenges like data compatibility, source reliability, data quality, processing speed, and scalability are also discussed. Finally, a classification of automation components along with an example orchestration architecture, illustrated (Figure 1) is presented. The survey concludes with an overview of current challenges and potential future developments in CTI automation and orchestration