How the AI agents work.
Liberty91 runs a set of specialised AI agents that work together on every Event. They are not one general-purpose model. Each agent does one job well, and the platform composes them to produce grounded, current intelligence. They fall into six categories: integration agents that work with external tools, entity extraction agents that pull structure out of raw reports, tradecraft agents that apply analytical technique, self-learning knowledge agents that build expertise on topics, organization agents that judge relevance to you, and production agents that write the finished products.
Integration agents
These agents are trained to work with external tools, so the platform can collect from and push to other systems. Examples include:
- VirusTotal, URLScan, Shodan, GreyNoise and AbuseIPDB.
- Google Threat Intelligence.
- CrowdStrike.
- AlienVault OTX.
- MISP.
- Group-IB.
- Slack.
Entity extraction agents
These agents are each dedicated and trained to pull one kind of entity out of an incoming report:
- Indicators of Compromise.
- MITRE ATT&CK techniques.
- Threat Entities.
- Sectors and regions, both target and origin.
- Assets.
- Suppliers.
Tradecraft agents
These supply the analysis skills that other agents draw on, so that every event is assessed with the same discipline a good analyst would apply, consistently. They cover:
- Analysis of Competing Hypotheses (ACH).
- The Diamond Model.
- The NATO Admiralty scale, used to rate a source and its data before it is trusted.
- The use of confidence and likelihood.
- Indicator pivoting across related infrastructure.
- Contrarian and devil's-advocate checks to counter bias.
- Strategic horizon scanning.
- Writing standards.
The agents supply the scaffolding; your analysts still make the call and own the judgement.
Knowledge agents
These agents are self-learning. Each builds and continuously maintains the entire body of knowledge on one topic over time, and uses it to contextualise every new event against what is already known:
- Regions.
- Sectors.
- Threat Entities.
- Intelligence Requirements.
Organization agents
These agents are trained on each Organization you protect. They learn what kind of business it is, its Assets, its Suppliers, and its threat profile, and they judge the relevance of every event and datapoint to that specific organization. This is what makes the output yours rather than generic. An MSSP gets a dedicated organization agent per customer.
Production agents
These agents turn the finished analysis into the right product for each audience, from the same underlying work:
- Strategic and technical reports for human readers.
- Detection and SIGMA rules.
- Indicators of Compromise and blocklists.
- STIX bundles.
IOC enrichment
IOC enrichment follows the decaying-indicators research pioneered by the CIRCL team at MISP. That work sets the base scores and decay behaviour the platform applies to every indicator. See IOC enrichment and decay scoring for how scoring and expiry work.
Frequently asked questions
What are the categories of agent?
Integration agents that work with external tools, entity extraction agents that pull structure out of raw reports, tradecraft agents that apply analysis techniques, self-learning knowledge agents that build expertise on topics, organization agents that judge relevance to you, and production agents that write the finished products.
Does IOC scoring follow an established method?
Yes. IOC enrichment follows the decaying-indicators research pioneered by the CIRCL team at MISP, which sets the base scores and decay behaviour Liberty91 uses.