In this episode, Karan Alang, Principal Software Engineer at Versa Networks, joins the conversation to discuss how Airflow can be used to automate threat intelligence in modern cybersecurity environments. He explains the growing scale of cloud computing, the profitability of hacking and the shortage of SOC analysts. Karan also outlines a novel architecture that combines Airflow, XDR, graph databases and LLMs to orchestrate automated threat detection and response.

Key Takeaways:

• 00:00 Introduction.
• 05:00 Organizations face massive log volumes and a shortage of SOC analysts.
• 07:00 The solution integrates Airflow, XDR, Neo4j graph databases and LLMs into one architecture.
• 08:00 MITRE ATT&CK provides a global framework for mapping tactics and techniques.
• 11:00 Airflow acts as the orchestration backbone for ingestion graph transformation and LLM workflows.
• 13:00 Graph databases provide a full relationship view of attackers’ systems and entities.
• 14:00 LLMs automate mapping activity to MITRE ATT&CK and assign explainable risk scores.
• 17:00 Traditional signature-based detection allows lateral movement and exfiltration before teams can react.
• 18:00 End-to-end automation is essential to mitigating modern cybersecurity threats.
• 20:00 Future opportunities include deeper LLM integration as first-class citizens within Airflow.

Resources Mentioned:

• Versa Networks
• Google Cloud Composer (Managed Airflow on GCP)
• Microsoft Defender XDR
• Neo4j (Graph Database)
• MITRE ATT&CK Framework

Thanks for listening to “The Data Flowcast: Mastering Apache Airflow^® for Data Engineering and AI.” If you enjoyed this episode, please leave a 5-star review to help get the word out about the show. And be sure to subscribe so you never miss any of the insightful conversations.