[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE0CH5FR6C1DA3YCC33VSJ":3,"skill-same:01M6AE0CH5FR6C1DA3YCC33VSJ":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AE0CH5FR6C1DA3YCC33VSJ","building-threat-feed-aggregation-with-misp",null,"Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX\u002FTAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-feed-aggregation-with-misp\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"building threat feed aggregation with misp","MISP","splunk","siem-integration","correlation","sharing","aggregation","threat-feed","indicator","TAXII","docker","stix","ioc","threat-intelligence","integration","deploy","threat intelligence","soar","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-threat-feed-aggregation-with-misp\ndescription: Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX\u002FTAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- misp\n- threat-feed\n- aggregation\n- indicator\n- sharing\n- correlation\n- siem-integration\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1071\n- T1105\n- T1588.001\n---\n# Building Threat Feed Aggregation with MISP\n\n## Overview\n\nMISP is the leading open-source threat intelligence platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat intelligence. It aggregates feeds from OSINT sources, commercial providers, and sharing communities into a unified platform with automatic correlation, STIX\u002FTAXII export, and direct integration with SIEMs and security tools. This skill covers deploying MISP via Docker, configuring feeds from sources like abuse.ch, AlienVault OTX, and CIRCL, setting up automated feed synchronization, and integrating with Splunk, Elasticsearch, and SOAR platforms.\n\n\n## When to Use\n\n- When deploying or configuring building threat feed aggregation with misp capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deployment\n- Python 3.9+ with `pymisp` library for API interaction\n- Linux server with 8GB+ RAM for production deployment\n- Understanding of IOC types and threat intelligence lifecycle\n- Network access to external feed URLs\n\n## Key Concepts\n\n### MISP Architecture\n\nMISP stores threat intelligence as Events containing Attributes (IOCs) organized by type and category. Events can have Tags (MITRE ATT&CK, TLP marking, sector tags), Galaxies (threat actor profiles, malware families, attack patterns), and Objects (structured groupings of related attributes). Events are correlated automatically across the instance.\n\n### Feed Types\n\nMISP supports three feed formats: MISP format (native JSON events), CSV (comma-separated IOCs), and freetext (unstructured text with automatic IOC extraction). Feeds can be remote (fetched from URLs) or local (uploaded files). MISP ships with 80+ default OSINT feeds including abuse.ch URLhaus, Botvrij, CIRCL OSINT, and malware traffic analysis.\n\n### Sharing and Synchronization\n\nMISP instances can synchronize with other MISP instances via push\u002Fpull mechanisms. Sharing groups control distribution (organization only, this community, connected communities, all communities). The TAXII server module enables integration with STIX\u002FTAXII consumers.\n\n## Workflow\n\n### Step 1: Deploy MISP with Docker\n\n```yaml\n# docker-compose.yml for MISP deployment\nversion: '3.8'\nservices:\n  misp:\n    image: coolacid\u002Fmisp-docker:core-latest\n    container_name: misp\n    restart: unless-stopped\n    ports:\n      - \"443:443\"\n      - \"80:80\"\n    environment:\n      - MYSQL_HOST=misp-db\n      - MYSQL_DATABASE=misp\n      - MYSQL_USER=misp\n      - MYSQL_PASSWORD=misp_db_password_change_me\n      - MISP_ADMIN_EMAIL=admin@organization.com\n      - MISP_ADMIN_PASSPHRASE=admin_password_change_me\n      - MISP_BASEURL=https:\u002F\u002Fmisp.organization.com\n      - POSTFIX_RELAY_HOST=smtp.organization.com\n      - TIMEZONE=UTC\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n      - misp-config:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002FConfig\n    depends_on:\n      - misp-db\n      - misp-redis\n\n  misp-db:\n    image: mysql:8.0\n    container_name: misp-db\n    restart: unless-stopped\n    environment:\n      - MYSQL_DATABASE=misp\n      - MYSQL_USER=misp\n      - MYSQL_PASSWORD=misp_db_password_change_me\n      - MYSQL_ROOT_PASSWORD=root_password_change_me\n    volumes:\n      - misp-db-data:\u002Fvar\u002Flib\u002Fmysql\n\n  misp-redis:\n    image: redis:7\n    container_name: misp-redis\n    restart: unless-stopped\n\nvolumes:\n  misp-data:\n  misp-config:\n  misp-db-data:\n```\n\n### Step 2: Configure Feeds via PyMISP API\n\n```python\nfrom pymisp import PyMISP, MISPFeed\nimport json\n\nclass MISPFeedManager:\n    def __init__(self, misp_url, misp_key, verify_ssl=False):\n        self.misp = PyMISP(misp_url, misp_key, verify_ssl)\n        print(f\"[+] Connected to MISP: {misp_url}\")\n\n    def list_feeds(self):\n        \"\"\"List all configured feeds.\"\"\"\n        feeds = self.misp.feeds()\n        enabled = [f for f in feeds if f.get(\"Feed\", {}).get(\"enabled\")]\n        disabled = [f for f in feeds if not f.get(\"Feed\", {}).get(\"enabled\")]\n        print(f\"[+] Feeds: {len(enabled)} enabled, {len(disabled)} disabled\")\n        return feeds\n\n    def enable_default_feeds(self):\n        \"\"\"Enable recommended default OSINT feeds.\"\"\"\n        recommended_feeds = [\n            \"CIRCL OSINT Feed\",\n            \"Botvrij.eu - Indicators of Compromise\",\n            \"abuse.ch URLhaus Host file\",\n            \"abuse.ch Feodo Tracker\",\n            \"abuse.ch SSL Blacklist\",\n            \"malwaredomainlist\",\n            \"CyberCure - IP Feed\",\n        ]\n\n        feeds = self.misp.feeds()\n        enabled_count = 0\n        for feed in feeds:\n            feed_data = feed.get(\"Feed\", {})\n            if feed_data.get(\"name\") in recommended_feeds:\n                if not feed_data.get(\"enabled\"):\n                    self.misp.enable_feed(feed_data[\"id\"])\n                    self.misp.enable_feed_cache(feed_data[\"id\"])\n                    enabled_count += 1\n                    print(f\"  [+] Enabled: {feed_data['name']}\")\n\n        print(f\"[+] Enabled {enabled_count} feeds\")\n\n    def add_custom_feed(self, name, url, provider, feed_format=\"csv\",\n                        input_source=\"network\", enabled=True):\n        \"\"\"Add a custom threat intelligence feed.\"\"\"\n        feed = MISPFeed()\n        feed.name = name\n        feed.provider = provider\n        feed.url = url\n        feed.source_format = feed_format\n        feed.input_source = input_source\n        feed.enabled = enabled\n        feed.caching_enabled = True\n        feed.publish = False\n        feed.distribution = \"3\"  # All communities\n\n        result = self.misp.add_feed(feed)\n        if \"Feed\" in result:\n            feed_id = result[\"Feed\"][\"id\"]\n            print(f\"[+] Added feed: {name} (ID: {feed_id})\")\n            return feed_id\n        else:\n            print(f\"[-] Error adding feed: {result}\")\n            return None\n\n    def fetch_all_feeds(self):\n        \"\"\"Trigger fetch for all enabled feeds.\"\"\"\n        feeds = self.misp.feeds()\n        for feed in feeds:\n            feed_data = feed.get(\"Feed\", {})\n            if feed_data.get(\"enabled\"):\n                self.misp.fetch_feed(feed_data[\"id\"])\n                print(f\"  [*] Fetching: {feed_data['name']}\")\n        print(\"[+] Feed fetch triggered for all enabled feeds\")\n\nmanager = MISPFeedManager(\n    \"https:\u002F\u002Fmisp.organization.com\",\n    \"YOUR_MISP_API_KEY\",\n)\nmanager.enable_default_feeds()\nmanager.add_custom_feed(\n    name=\"Abuse.ch MalwareBazaar Recent\",\n    url=\"https:\u002F\u002Fbazaar.abuse.ch\u002Fexport\u002Fcsv\u002Frecent\u002F\",\n    provider=\"abuse.ch\",\n    feed_format=\"csv\",\n)\nmanager.fetch_all_feeds()\n```\n\n### Step 3: Search and Correlate Indicators\n\n```python\ndef search_indicators(misp, value=None, type_attribute=None, tags=None, last_days=30):\n    \"\"\"Search MISP for indicators with correlation.\"\"\"\n    from datetime import datetime, timedelta\n    date_from = (datetime.now() - timedelta(days=last_days)).strftime(\"%Y-%m-%d\")\n\n    search_params = {\n        \"date_from\": date_from,\n        \"published\": True,\n        \"enforceWarninglist\": True,\n    }\n    if value:\n        search_params[\"value\"] = value\n    if type_attribute:\n        search_params[\"type_attribute\"] = type_attribute\n    if tags:\n        search_params[\"tags\"] = tags\n\n    results = misp.search(\"attributes\", **search_params)\n    attributes = results.get(\"Attribute\", [])\n    print(f\"[+] Search returned {len(attributes)} attributes\")\n\n    # Group by event for context\n    events = {}\n    for attr in attributes:\n        event_id = attr.get(\"event_id\", \"\")\n        if event_id not in events:\n            events[event_id] = {\"attributes\": [], \"tags\": set()}\n        events[event_id][\"attributes\"].append({\n            \"type\": attr.get(\"type\", \"\"),\n            \"value\": attr.get(\"value\", \"\"),\n            \"category\": attr.get(\"category\", \"\"),\n            \"timestamp\": attr.get(\"timestamp\", \"\"),\n        })\n        for tag in attr.get(\"Tag\", []):\n            events[event_id][\"tags\"].add(tag.get(\"name\", \"\"))\n\n    return {\"attributes\": attributes, \"events\": events}\n\n# Search for specific IOC\nmisp = manager.misp\nresults = search_indicators(misp, value=\"203.0.113.1\")\nresults_by_type = search_indicators(misp, type_attribute=\"ip-dst\", last_days=7)\nresults_by_tag = search_indicators(misp, tags=[\"tlp:white\", \"type:OSINT\"])\n```\n\n### Step 4: Export to SIEM (Splunk \u002F Elasticsearch)\n\n```python\nimport requests\nfrom datetime import datetime, timedelta\n\nclass MISPSIEMExporter:\n    def __init__(self, misp_client):\n        self.misp = misp_client\n\n    def export_to_splunk(self, splunk_url, hec_token, days=7):\n        \"\"\"Export recent MISP indicators to Splunk via HEC.\"\"\"\n        date_from = (datetime.now() - timedelta(days=days)).strftime(\"%Y-%m-%d\")\n        results = self.misp.search(\"attributes\", date_from=date_from,\n                                    published=True, enforceWarninglist=True)\n        attributes = results.get(\"Attribute\", [])\n\n        headers = {\"Authorization\": f\"Splunk {hec_token}\"}\n        exported = 0\n        for attr in attributes:\n            event = {\n                \"event\": {\n                    \"ioc_type\": attr.get(\"type\", \"\"),\n                    \"ioc_value\": attr.get(\"value\", \"\"),\n                    \"category\": attr.get(\"category\", \"\"),\n                    \"event_id\": attr.get(\"event_id\", \"\"),\n                    \"timestamp\": attr.get(\"timestamp\", \"\"),\n                    \"tags\": [t.get(\"name\", \"\") for t in attr.get(\"Tag\", [])],\n                },\n                \"sourcetype\": \"misp:attribute\",\n                \"source\": \"misp\",\n                \"index\": \"threat_intel\",\n            }\n            resp = requests.post(\n                f\"{splunk_url}\u002Fservices\u002Fcollector\u002Fevent\",\n                headers=headers, json=event,\n                verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n            )\n            if resp.status_code == 200:\n                exported += 1\n\n        print(f\"[+] Exported {exported}\u002F{len(attributes)} indicators to Splunk\")\n\n    def export_ioc_list(self, output_file, ioc_types=None, days=30):\n        \"\"\"Export flat IOC list for firewall\u002Fproxy blocklists.\"\"\"\n        ioc_types = ioc_types or [\"ip-dst\", \"domain\", \"hostname\", \"url\"]\n        date_from = (datetime.now() - timedelta(days=days)).strftime(\"%Y-%m-%d\")\n\n        all_iocs = []\n        for ioc_type in ioc_types:\n            results = self.misp.search(\n                \"attributes\", type_attribute=ioc_type,\n                date_from=date_from, published=True,\n                enforceWarninglist=True,\n            )\n            for attr in results.get(\"Attribute\", []):\n                all_iocs.append(attr.get(\"value\", \"\"))\n\n        unique_iocs = sorted(set(all_iocs))\n        with open(output_file, \"w\") as f:\n            for ioc in unique_iocs:\n                f.write(f\"{ioc}\\n\")\n\n        print(f\"[+] Exported {len(unique_iocs)} unique IOCs to {output_file}\")\n\nexporter = MISPSIEMExporter(misp)\nexporter.export_ioc_list(\"blocklist_ips.txt\", ioc_types=[\"ip-dst\"], days=7)\n```\n\n## Validation Criteria\n\n- MISP deployed and accessible via web interface and API\n- Default OSINT feeds enabled and fetching data\n- Custom feeds added and ingesting indicators\n- Indicators searchable with correlation across events\n- IOCs exported to SIEM (Splunk\u002FElasticsearch) successfully\n- Blocklists generated for firewall\u002Fproxy integration\n\n## References\n\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [MISP GitHub Repository](https:\u002F\u002Fgithub.com\u002FMISP\u002FMISP)\n- [MISP Default Feeds](https:\u002F\u002Fwww.misp-project.org\u002Ffeeds\u002F)\n- [PyMISP Documentation](https:\u002F\u002Fpymisp.readthedocs.io\u002F)\n- [Kraven Security: MISP Using Feeds](https:\u002F\u002Fkravensecurity.com\u002Fthreat-intelligence-with-misp-part-4-using-feeds\u002F)\n- [Cosive: What is MISP](https:\u002F\u002Fwww.cosive.com\u002Fblog\u002Fwhat-is-misp-the-ultimate-introduction)\n","# Building Threat Feed Aggregation with MISP\n\n## Overview\n\nMISP is the leading open-source threat intelligence platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat intelligence. It aggregates feeds from OSINT sources, commercial providers, and sharing communities into a unified platform with automatic correlation, STIX\u002FTAXII export, and direct integration with SIEMs and security tools. This skill covers deploying MISP via Docker, configuring feeds from sources like abuse.ch, AlienVault OTX, and CIRCL, setting up automated feed synchronization, and integrating with Splunk, Elasticsearch, and SOAR platforms.\n\n\n## When to Use\n\n- When deploying or configuring building threat feed aggregation with misp capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deployment\n- Python 3.9+ with `pymisp` library for API interaction\n- Linux server with 8GB+ RAM for production deployment\n- Understanding of IOC types and threat intelligence lifecycle\n- Network access to external feed URLs\n\n## Key Concepts\n\n### MISP Architecture\n\nMISP stores threat intelligence as Events containing Attributes (IOCs) organized by type and category. Events can have Tags (MITRE ATT&CK, TLP marking, sector tags), Galaxies (threat actor profiles, malware families, attack patterns), and Objects (structured groupings of related attributes). Events are correlated automatically across the instance.\n\n### Feed Types\n\nMISP supports three feed formats: MISP format (native JSON events), CSV (comma-separated IOCs), and freetext (unstructured text with automatic IOC extraction). Feeds can be remote (fetched from URLs) or local (uploaded files). MISP ships with 80+ default OSINT feeds including abuse.ch URLhaus, Botvrij, CIRCL OSINT, and malware traffic analysis.\n\n### Sharing and Synchronization\n\nMISP instances can synchronize with other MISP instances via push\u002Fpull mechanisms. Sharing groups control distribution (organization only, this community, connected communities, all communities). The TAXII server module enables integration with STIX\u002FTAXII consumers.\n\n## Workflow\n\n### Step 1: Deploy MISP with Docker\n\n```yaml\n# docker-compose.yml for MISP deployment\nversion: '3.8'\nservices:\n  misp:\n    image: coolacid\u002Fmisp-docker:core-latest\n    container_name: misp\n    restart: unless-stopped\n    ports:\n      - \"443:443\"\n      - \"80:80\"\n    environment:\n      - MYSQL_HOST=misp-db\n      - MYSQL_DATABASE=misp\n      - MYSQL_USER=misp\n      - MYSQL_PASSWORD=misp_db_password_change_me\n      - MISP_ADMIN_EMAIL=admin@organization.com\n      - MISP_ADMIN_PASSPHRASE=admin_password_change_me\n      - MISP_BASEURL=https:\u002F\u002Fmisp.organization.com\n      - POSTFIX_RELAY_HOST=smtp.organization.com\n      - TIMEZONE=UTC\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n      - misp-config:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002FConfig\n    depends_on:\n      - misp-db\n      - misp-redis\n\n  misp-db:\n    image: mysql:8.0\n    container_name: misp-db\n    restart: unless-stopped\n    environment:\n      - MYSQL_DATABASE=misp\n      - MYSQL_USER=misp\n      - MYSQL_PASSWORD=misp_db_password_change_me\n      - MYSQL_ROOT_PASSWORD=root_password_change_me\n    volumes:\n      - misp-db-data:\u002Fvar\u002Flib\u002Fmysql\n\n  misp-redis:\n    image: redis:7\n    container_name: misp-redis\n    restart: unless-stopped\n\nvolumes:\n  misp-data:\n  misp-config:\n  misp-db-data:\n```\n\n### Step 2: Configure Feeds via PyMISP API\n\n```python\nfrom pymisp import PyMISP, MISPFeed\nimport json\n\nclass MISPFeedManager:\n    def __init__(self, misp_url, misp_key, verify_ssl=False):\n        self.misp = PyMISP(misp_url, misp_key, verify_ssl)\n        print(f\"[+] Connected to MISP: {misp_url}\")\n\n    def list_feeds(self):\n        \"\"\"List all configured feeds.\"\"\"\n        feeds = self.misp.feeds()\n        enabled = [f for f in feeds if f.get(\"Feed\", {}).get(\"enabled\")]\n        disabled = [f for f in feeds if not f.get(\"Feed\", {}).get(\"enabled\")]\n        print(f\"[+] Feeds: {len(enabled)} enabled, {len(disabled)} disabled\")\n        return feeds\n\n    def enable_default_feeds(self):\n        \"\"\"Enable recommended default OSINT feeds.\"\"\"\n        recommended_feeds = [\n            \"CIRCL OSINT Feed\",\n            \"Botvrij.eu - Indicators of Compromise\",\n            \"abuse.ch URLhaus Host file\",\n            \"abuse.ch Feodo Tracker\",\n            \"abuse.ch SSL Blacklist\",\n            \"malwaredomainlist\",\n            \"CyberCure - IP Feed\",\n        ]\n\n        feeds = self.misp.feeds()\n        enabled_count = 0\n        for feed in feeds:\n            feed_data = feed.get(\"Feed\", {})\n            if feed_data.get(\"name\") in recommended_feeds:\n                if not feed_data.get(\"enabled\"):\n                    self.misp.enable_feed(feed_data[\"id\"])\n                    self.misp.enable_feed_cache(feed_data[\"id\"])\n                    enabled_count += 1\n                    print(f\"  [+] Enabled: {feed_data['name']}\")\n\n        print(f\"[+] Enabled {enabled_count} feeds\")\n\n    def add_custom_feed(self, name, url, provider, feed_format=\"csv\",\n                        input_source=\"network\", enabled=True):\n        \"\"\"Add a custom threat intelligence feed.\"\"\"\n        feed = MISPFeed()\n        feed.name = name\n        feed.provider = provider\n        feed.url = url\n        feed.source_format = feed_format\n        feed.input_source = input_source\n        feed.enabled = enabled\n        feed.caching_enabled = True\n        feed.publish = False\n        feed.distribution = \"3\"  # All communities\n\n        result = self.misp.add_feed(feed)\n        if \"Feed\" in result:\n            feed_id = result[\"Feed\"][\"id\"]\n            print(f\"[+] Added feed: {name} (ID: {feed_id})\")\n            return feed_id\n        else:\n            print(f\"[-] Error adding feed: {result}\")\n            return None\n\n    def fetch_all_feeds(self):\n        \"\"\"Trigger fetch for all enabled feeds.\"\"\"\n        feeds = self.misp.feeds()\n        for feed in feeds:\n            feed_data = feed.get(\"Feed\", {})\n            if feed_data.get(\"enabled\"):\n                self.misp.fetch_feed(feed_data[\"id\"])\n                print(f\"  [*] Fetching: {feed_data['name']}\")\n        print(\"[+] Feed fetch triggered for all enabled feeds\")\n\nmanager = MISPFeedManager(\n    \"https:\u002F\u002Fmisp.organization.com\",\n    \"YOUR_MISP_API_KEY\",\n)\nmanager.enable_default_feeds()\nmanager.add_custom_feed(\n    name=\"Abuse.ch MalwareBazaar Recent\",\n    url=\"https:\u002F\u002Fbazaar.abuse.ch\u002Fexport\u002Fcsv\u002Frecent\u002F\",\n    provider=\"abuse.ch\",\n    feed_format=\"csv\",\n)\nmanager.fetch_all_feeds()\n```\n\n### Step 3: Search and Correlate Indicators\n\n```python\ndef search_indicators(misp, value=None, type_attribute=None, tags=None, last_days=30):\n    \"\"\"Search MISP for indicators with correlation.\"\"\"\n    from datetime import datetime, timedelta\n    date_from = (datetime.now() - timedelta(days=last_days)).strftime(\"%Y-%m-%d\")\n\n    search_params = {\n        \"date_from\": date_from,\n        \"published\": True,\n        \"enforceWarninglist\": True,\n    }\n    if value:\n        search_params[\"value\"] = value\n    if type_attribute:\n        search_params[\"type_attribute\"] = type_attribute\n    if tags:\n        search_params[\"tags\"] = tags\n\n    results = misp.search(\"attributes\", **search_params)\n    attributes = results.get(\"Attribute\", [])\n    print(f\"[+] Search returned {len(attributes)} attributes\")\n\n    # Group by event for context\n    events = {}\n    for attr in attributes:\n        event_id = attr.get(\"event_id\", \"\")\n        if event_id not in events:\n            events[event_id] = {\"attributes\": [], \"tags\": set()}\n        events[event_id][\"attributes\"].append({\n            \"type\": attr.get(\"type\", \"\"),\n            \"value\": attr.get(\"value\", \"\"),\n            \"category\": attr.get(\"category\", \"\"),\n            \"timestamp\": attr.get(\"timestamp\", \"\"),\n        })\n        for tag in attr.get(\"Tag\", []):\n            events[event_id][\"tags\"].add(tag.get(\"name\", \"\"))\n\n    return {\"attributes\": attributes, \"events\": events}\n\n# Search for specific IOC\nmisp = manager.misp\nresults = search_indicators(misp, value=\"203.0.113.1\")\nresults_by_type = search_indicators(misp, type_attribute=\"ip-dst\", last_days=7)\nresults_by_tag = search_indicators(misp, tags=[\"tlp:white\", \"type:OSINT\"])\n```\n\n### Step 4: Export to SIEM (Splunk \u002F Elasticsearch)\n\n```python\nimport requests\nfrom datetime import datetime, timedelta\n\nclass MISPSIEMExporter:\n    def __init__(self, misp_client):\n        self.misp = misp_client\n\n    def export_to_splunk(self, splunk_url, hec_token, days=7):\n        \"\"\"Export recent MISP indicators to Splunk via HEC.\"\"\"\n        date_from = (datetime.now() - timedelta(days=days)).strftime(\"%Y-%m-%d\")\n        results = self.misp.search(\"attributes\", date_from=date_from,\n                                    published=True, enforceWarninglist=True)\n        attributes = results.get(\"Attribute\", [])\n\n        headers = {\"Authorization\": f\"Splunk {hec_token}\"}\n        exported = 0\n        for attr in attributes:\n            event = {\n                \"event\": {\n                    \"ioc_type\": attr.get(\"type\", \"\"),\n                    \"ioc_value\": attr.get(\"value\", \"\"),\n                    \"category\": attr.get(\"category\", \"\"),\n                    \"event_id\": attr.get(\"event_id\", \"\"),\n                    \"timestamp\": attr.get(\"timestamp\", \"\"),\n                    \"tags\": [t.get(\"name\", \"\") for t in attr.get(\"Tag\", [])],\n                },\n                \"sourcetype\": \"misp:attribute\",\n                \"source\": \"misp\",\n                \"index\": \"threat_intel\",\n            }\n            resp = requests.post(\n                f\"{splunk_url}\u002Fservices\u002Fcollector\u002Fevent\",\n                headers=headers, json=event,\n                verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n            )\n            if resp.status_code == 200:\n                exported += 1\n\n        print(f\"[+] Exported {exported}\u002F{len(attributes)} indicators to Splunk\")\n\n    def export_ioc_list(self, output_file, ioc_types=None, days=30):\n        \"\"\"Export flat IOC list for firewall\u002Fproxy blocklists.\"\"\"\n        ioc_types = ioc_types or [\"ip-dst\", \"domain\", \"hostname\", \"url\"]\n        date_from = (datetime.now() - timedelta(days=days)).strftime(\"%Y-%m-%d\")\n\n        all_iocs = []\n        for ioc_type in ioc_types:\n            results = self.misp.search(\n                \"attributes\", type_attribute=ioc_type,\n                date_from=date_from, published=True,\n                enforceWarninglist=True,\n            )\n            for attr in results.get(\"Attribute\", []):\n                all_iocs.append(attr.get(\"value\", \"\"))\n\n        unique_iocs = sorted(set(all_iocs))\n        with open(output_file, \"w\") as f:\n            for ioc in unique_iocs:\n                f.write(f\"{ioc}\\n\")\n\n        print(f\"[+] Exported {len(unique_iocs)} unique IOCs to {output_file}\")\n\nexporter = MISPSIEMExporter(misp)\nexporter.export_ioc_list(\"blocklist_ips.txt\", ioc_types=[\"ip-dst\"], days=7)\n```\n\n## Validation Criteria\n\n- MISP deployed and accessible via web interface and API\n- Default OSINT feeds enabled and fetching data\n- Custom feeds added and ingesting indicators\n- Indicators searchable with correlation across events\n- IOCs exported to SIEM (Splunk\u002FElasticsearch) successfully\n- Blocklists generated for firewall\u002Fproxy integration\n\n## References\n\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [MISP GitHub Repository](https:\u002F\u002Fgithub.com\u002FMISP\u002FMISP)\n- [MISP Default Feeds](https:\u002F\u002Fwww.misp-project.org\u002Ffeeds\u002F)\n- [PyMISP Documentation](https:\u002F\u002Fpymisp.readthedocs.io\u002F)\n- [Kraven Security: MISP Using Feeds](https:\u002F\u002Fkravensecurity.com\u002Fthreat-intelligence-with-misp-part-4-using-feeds\u002F)\n- [Cosive: What is MISP](https:\u002F\u002Fwww.cosive.com\u002Fblog\u002Fwhat-is-misp-the-ultimate-introduction)\n",{"name":5,"tags":52,"author":54,"domain":46,"license":15,"version":55,"nist_csf":56,"subdomain":40,"description":7,"mitre_attack":61},[53,34,33,35,32,31,30,40],"misp","mahipal","1.0",[57,58,59,60],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[62,63,64],"T1071","T1105","T1588.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-threat-feed-aggregation-with-misp",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-threat-feed-aggregation-with-misp",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-threat-feed-aggregation-with-misp",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-threat-feed-aggregation-with-misp","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-feed-aggregation-with-misp\u002FSKILL.md",true,[89,94,100],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-feed-aggregation-with-misp\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",2135,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-feed-aggregation-with-misp\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",6731,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-feed-aggregation-with-misp\u002Fscripts\u002Fagent.py",[107,134,158,186,212,239],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":114,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[113],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[115,116,117,118,119,46,120,121,122,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,119,145,46,122,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[152,169,170,171,172,46,173,174,146,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,46,197,198,199,200,201,202,203,204,205,206,207,208,149,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,46,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[119,247,46,45,248,39,249,250,251,252,253,181,254,182,255,256,257,258,259,260],"triaging security incident","file","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]