[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE0Q2CFF8HRT8HF6TE4M8D":3,"skill-same:01M6AE0Q2CFF8HRT8HF6TE4M8D":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AE0Q2CFF8HRT8HF6TE4M8D","building-threat-intelligence-feed-integration",null,"Builds automated threat intelligence feed integration pipelines connecting STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"building threat intelligence feed integration","threat intelligence","integration","threat-intelligence","feeds","siem-integration","TAXII","MISP","soc","stix","ioc","security","alerting","teams","security tools","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-threat-intelligence-feed-integration\ndescription: 'Builds automated threat intelligence feed integration pipelines connecting\n  STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM\n  and security tools for real-time IOC matching and alerting. Use when SOC teams need\n  to operationalize threat intelligence by automating feed ingestion, normalization,\n  scoring, and distribution to detection systems.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- threat-intelligence\n- stix\n- taxii\n- misp\n- feeds\n- ioc\n- siem-integration\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1071\n- T1105\n- T1588.001\n---\n# Building Threat Intelligence Feed Integration\n\n## When to Use\n\nUse this skill when:\n- SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms\n- Multiple TI sources require normalization into a common format (STIX 2.1)\n- Detection systems need real-time IOC matching against network and endpoint telemetry\n- TI feed quality assessment and deduplication processes need to be established\n\n**Do not use** for manual IOC lookup — use dedicated enrichment tools (VirusTotal, AbuseIPDB) for ad-hoc queries.\n\n## Prerequisites\n\n- MISP instance or Threat Intelligence Platform (TIP) for feed aggregation\n- STIX\u002FTAXII client library (`taxii2-client`, `stix2` Python packages)\n- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with TI framework configured\n- API keys for commercial and open-source feeds (AlienVault OTX, Abuse.ch, CISA AIS)\n- Python 3.8+ for feed processing automation\n\n## Workflow\n\n### Step 1: Identify and Catalog Intelligence Sources\n\nMap available feeds by type, format, and update frequency:\n\n| Feed Source | Format | IOC Types | Update Freq | Cost |\n|-------------|--------|-----------|-------------|------|\n| AlienVault OTX | STIX\u002FJSON | IP, Domain, Hash, URL | Real-time | Free |\n| Abuse.ch URLhaus | CSV\u002FJSON | URL, Domain | Every 5 min | Free |\n| Abuse.ch MalwareBazaar | JSON API | File Hash | Real-time | Free |\n| CISA AIS | STIX\u002FTAXII 2.1 | All types | Daily | Free (US Gov) |\n| CrowdStrike Intel | STIX\u002FJSON | All types + Actor TTP | Real-time | Commercial |\n| Mandiant Advantage | STIX 2.1 | All types + Reports | Real-time | Commercial |\n\n### Step 2: Ingest STIX\u002FTAXII Feeds\n\nConnect to a TAXII 2.1 server and download indicators:\n\n```python\nfrom taxii2client.v21 import Server, Collection\nfrom stix2 import parse\n\n# Connect to TAXII server (example: CISA AIS)\nserver = Server(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# List available collections\nfor api_root in server.api_roots:\n    print(f\"API Root: {api_root.title}\")\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a collection\ncollection = Collection(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# Get indicators added in last 24 hours\nfrom datetime import datetime, timedelta\nadded_after = (datetime.utcnow() - timedelta(days=1)).strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n\nresponse = collection.get_objects(added_after=added_after, type=[\"indicator\"])\nfor obj in response.get(\"objects\", []):\n    indicator = parse(obj)\n    print(f\"Type: {indicator.type}\")\n    print(f\"Pattern: {indicator.pattern}\")\n    print(f\"Valid Until: {indicator.valid_until}\")\n    print(f\"Confidence: {indicator.confidence}\")\n    print(\"---\")\n```\n\n### Step 3: Ingest Open-Source Feeds\n\n**Abuse.ch URLhaus Feed:**\n\n```python\nimport requests\nimport csv\nfrom io import StringIO\n\n# Download URLhaus recent URLs\nresponse = requests.get(\"https:\u002F\u002Furlhaus.abuse.ch\u002Fdownloads\u002Fcsv_recent\u002F\")\nreader = csv.reader(StringIO(response.text), delimiter=',')\n\nindicators = []\nfor row in reader:\n    if row[0].startswith(\"#\"):\n        continue\n    indicators.append({\n        \"id\": row[0],\n        \"dateadded\": row[1],\n        \"url\": row[2],\n        \"url_status\": row[3],\n        \"threat\": row[5],\n        \"tags\": row[6]\n    })\n\nprint(f\"Ingested {len(indicators)} URLs from URLhaus\")\n\n# Filter for active threats only\nactive = [i for i in indicators if i[\"url_status\"] == \"online\"]\nprint(f\"Active threats: {len(active)}\")\n```\n\n**AlienVault OTX Pulse Feed:**\n\n```python\nfrom OTXv2 import OTXv2, IndicatorTypes\n\notx = OTXv2(\"YOUR_OTX_API_KEY\")\n\n# Get subscribed pulses (last 24 hours)\npulses = otx.getall(modified_since=\"2024-03-14T00:00:00\")\n\nfor pulse in pulses:\n    print(f\"Pulse: {pulse['name']}\")\n    print(f\"Tags: {pulse['tags']}\")\n    for indicator in pulse[\"indicators\"]:\n        print(f\"  IOC: {indicator['indicator']} ({indicator['type']})\")\n```\n\n**Abuse.ch Feodo Tracker (C2 IPs):**\n\n```python\nresponse = requests.get(\"https:\u002F\u002Ffeodotracker.abuse.ch\u002Fdownloads\u002Fipblocklist_recommended.json\")\nc2_data = response.json()\n\nfor entry in c2_data:\n    print(f\"IP: {entry['ip_address']}:{entry['port']}\")\n    print(f\"Malware: {entry['malware']}\")\n    print(f\"First Seen: {entry['first_seen']}\")\n    print(f\"Last Online: {entry['last_online']}\")\n```\n\n### Step 4: Normalize and Deduplicate\n\nConvert all feeds to STIX 2.1 format for standardization:\n\n```python\nfrom stix2 import Indicator, Bundle\nimport hashlib\n\ndef create_stix_indicator(ioc_value, ioc_type, source, confidence=50):\n    \"\"\"Convert raw IOC to STIX 2.1 indicator\"\"\"\n    pattern_map = {\n        \"ipv4\": f\"[ipv4-addr:value = '{ioc_value}']\",\n        \"domain\": f\"[domain-name:value = '{ioc_value}']\",\n        \"url\": f\"[url:value = '{ioc_value}']\",\n        \"sha256\": f\"[file:hashes.'SHA-256' = '{ioc_value}']\",\n        \"md5\": f\"[file:hashes.MD5 = '{ioc_value}']\",\n    }\n\n    return Indicator(\n        name=f\"{ioc_type}: {ioc_value}\",\n        pattern=pattern_map[ioc_type],\n        pattern_type=\"stix\",\n        valid_from=\"2024-03-15T00:00:00Z\",\n        confidence=confidence,\n        labels=[source],\n        custom_properties={\"x_source_feed\": source}\n    )\n\n# Deduplicate across sources\nseen_iocs = set()\nunique_indicators = []\n\nfor ioc in all_collected_iocs:\n    ioc_hash = hashlib.sha256(f\"{ioc['type']}:{ioc['value']}\".encode()).hexdigest()\n    if ioc_hash not in seen_iocs:\n        seen_iocs.add(ioc_hash)\n        unique_indicators.append(\n            create_stix_indicator(ioc[\"value\"], ioc[\"type\"], ioc[\"source\"])\n        )\n\nbundle = Bundle(objects=unique_indicators)\nprint(f\"Unique indicators: {len(unique_indicators)}\")\n```\n\n### Step 5: Push to SIEM Threat Intelligence Framework\n\n**Push to Splunk ES Threat Intelligence:**\n\n```python\nimport requests\n\nsplunk_url = \"https:\u002F\u002Fsplunk.company.com:8089\"\nheaders = {\"Authorization\": f\"Bearer {splunk_token}\"}\n\nfor indicator in unique_indicators:\n    # Extract IOC value from STIX pattern\n    ioc_value = indicator.pattern.split(\"'\")[1]\n\n    # Upload to Splunk ES threat intel collection\n    data = {\n        \"ip\": ioc_value,\n        \"description\": indicator.name,\n        \"weight\": indicator.confidence \u002F\u002F 10,\n        \"threat_key\": indicator.id,\n        \"source_feed\": indicator.get(\"x_source_feed\", \"unknown\")\n    }\n\n    requests.post(\n        f\"{splunk_url}\u002Fservices\u002Fdata\u002Fthreat_intel\u002Fitem\u002Fip_intel\",\n        headers=headers, data=data,\n        verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n    )\n```\n\n**Push to MISP for centralized management:**\n\n```python\nfrom pymisp import PyMISP, MISPEvent, MISPAttribute\n\nmisp = PyMISP(\"https:\u002F\u002Fmisp.company.com\", \"YOUR_MISP_API_KEY\")\n\n# Create event for feed batch\nevent = MISPEvent()\nevent.info = f\"TI Feed Import - {datetime.now().strftime('%Y-%m-%d')}\"\nevent.threat_level_id = 2  # Medium\nevent.analysis = 2  # Completed\n\n# Add indicators as attributes\nfor ioc in unique_indicators:\n    attr = MISPAttribute()\n    attr.type = \"ip-dst\" if \"ipv4\" in ioc.pattern else \"domain\"\n    attr.value = ioc.pattern.split(\"'\")[1]\n    attr.to_ids = True\n    attr.comment = f\"Source: {ioc.get('x_source_feed', 'mixed')}\"\n    event.add_attribute(**attr)\n\nresult = misp.add_event(event)\nprint(f\"MISP Event created: {result['Event']['id']}\")\n```\n\n### Step 6: Monitor Feed Health and Quality\n\nTrack feed effectiveness metrics:\n\n```spl\nindex=threat_intel sourcetype=\"threat_intel_manager\"\n| stats count AS total_iocs,\n        dc(threat_key) AS unique_iocs,\n        dc(source_feed) AS feed_count\n  by source_feed\n| join source_feed [\n    search index=notable source=\"Threat Intelligence\"\n    | stats count AS matches by source_feed\n  ]\n| eval match_rate = round(matches \u002F unique_iocs * 100, 2)\n| sort - match_rate\n| table source_feed, unique_iocs, matches, match_rate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — standardized JSON format for sharing threat intelligence objects |\n| **TAXII** | Trusted Automated eXchange of Indicator Information — transport protocol for sharing STIX data via REST API |\n| **TIP** | Threat Intelligence Platform — centralized system for aggregating, scoring, and distributing threat intelligence |\n| **IOC Scoring** | Process of assigning confidence values to indicators based on source reliability and corroboration |\n| **Feed Deduplication** | Removing duplicate IOCs across multiple sources while preserving multi-source attribution |\n| **IOC Expiration** | Time-to-live policy removing aged indicators (IP: 30 days, Domain: 90 days, Hash: 1 year) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence platform for feed aggregation, correlation, and sharing\n- **AlienVault OTX**: Free threat intelligence sharing platform with community pulse feeds\n- **Abuse.ch**: Suite of free threat feeds (URLhaus, MalwareBazaar, Feodo Tracker, ThreatFox)\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 native storage\n- **TAXII2 Client**: Python library for connecting to STIX\u002FTAXII 2.1 servers for automated indicator retrieval\n\n## Common Scenarios\n\n- **New Feed Onboarding**: Evaluate feed quality, map fields to STIX, configure automated ingestion pipeline\n- **Multi-SIEM Distribution**: Push normalized IOCs from MISP to Splunk, Elastic, and Sentinel simultaneously\n- **False Positive Reduction**: Score IOCs by source count and age, expire stale indicators automatically\n- **Feed Quality Audit**: Compare detection match rates across feeds to identify highest-value sources\n- **Incident IOC Sharing**: Package investigation IOCs as STIX bundle and share with ISACs via TAXII\n\n## Output Format\n\n```\nTHREAT INTEL FEED STATUS — Daily Report\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-15\nTotal IOCs:   45,892 active indicators\n\nFeed Health:\n  Feed                  IOCs    Matches  Match Rate  Status\n  Abuse.ch URLhaus      12,340  47       0.38%       HEALTHY\n  AlienVault OTX        18,567  23       0.12%       HEALTHY\n  Abuse.ch Feodo        1,203   12       1.00%       HEALTHY\n  CISA AIS              8,945   8        0.09%       HEALTHY\n  CrowdStrike Intel     4,837   31       0.64%       HEALTHY\n\nActions Today:\n  New IOCs ingested:    1,247\n  IOCs expired:         892\n  Duplicates removed:   156\n  SIEM matches:         121 notable events generated\n  False positives:      3 (CDN IPs removed from feed)\n```\n","# Building Threat Intelligence Feed Integration\n\n## When to Use\n\nUse this skill when:\n- SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms\n- Multiple TI sources require normalization into a common format (STIX 2.1)\n- Detection systems need real-time IOC matching against network and endpoint telemetry\n- TI feed quality assessment and deduplication processes need to be established\n\n**Do not use** for manual IOC lookup — use dedicated enrichment tools (VirusTotal, AbuseIPDB) for ad-hoc queries.\n\n## Prerequisites\n\n- MISP instance or Threat Intelligence Platform (TIP) for feed aggregation\n- STIX\u002FTAXII client library (`taxii2-client`, `stix2` Python packages)\n- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with TI framework configured\n- API keys for commercial and open-source feeds (AlienVault OTX, Abuse.ch, CISA AIS)\n- Python 3.8+ for feed processing automation\n\n## Workflow\n\n### Step 1: Identify and Catalog Intelligence Sources\n\nMap available feeds by type, format, and update frequency:\n\n| Feed Source | Format | IOC Types | Update Freq | Cost |\n|-------------|--------|-----------|-------------|------|\n| AlienVault OTX | STIX\u002FJSON | IP, Domain, Hash, URL | Real-time | Free |\n| Abuse.ch URLhaus | CSV\u002FJSON | URL, Domain | Every 5 min | Free |\n| Abuse.ch MalwareBazaar | JSON API | File Hash | Real-time | Free |\n| CISA AIS | STIX\u002FTAXII 2.1 | All types | Daily | Free (US Gov) |\n| CrowdStrike Intel | STIX\u002FJSON | All types + Actor TTP | Real-time | Commercial |\n| Mandiant Advantage | STIX 2.1 | All types + Reports | Real-time | Commercial |\n\n### Step 2: Ingest STIX\u002FTAXII Feeds\n\nConnect to a TAXII 2.1 server and download indicators:\n\n```python\nfrom taxii2client.v21 import Server, Collection\nfrom stix2 import parse\n\n# Connect to TAXII server (example: CISA AIS)\nserver = Server(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# List available collections\nfor api_root in server.api_roots:\n    print(f\"API Root: {api_root.title}\")\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a collection\ncollection = Collection(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# Get indicators added in last 24 hours\nfrom datetime import datetime, timedelta\nadded_after = (datetime.utcnow() - timedelta(days=1)).strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n\nresponse = collection.get_objects(added_after=added_after, type=[\"indicator\"])\nfor obj in response.get(\"objects\", []):\n    indicator = parse(obj)\n    print(f\"Type: {indicator.type}\")\n    print(f\"Pattern: {indicator.pattern}\")\n    print(f\"Valid Until: {indicator.valid_until}\")\n    print(f\"Confidence: {indicator.confidence}\")\n    print(\"---\")\n```\n\n### Step 3: Ingest Open-Source Feeds\n\n**Abuse.ch URLhaus Feed:**\n\n```python\nimport requests\nimport csv\nfrom io import StringIO\n\n# Download URLhaus recent URLs\nresponse = requests.get(\"https:\u002F\u002Furlhaus.abuse.ch\u002Fdownloads\u002Fcsv_recent\u002F\")\nreader = csv.reader(StringIO(response.text), delimiter=',')\n\nindicators = []\nfor row in reader:\n    if row[0].startswith(\"#\"):\n        continue\n    indicators.append({\n        \"id\": row[0],\n        \"dateadded\": row[1],\n        \"url\": row[2],\n        \"url_status\": row[3],\n        \"threat\": row[5],\n        \"tags\": row[6]\n    })\n\nprint(f\"Ingested {len(indicators)} URLs from URLhaus\")\n\n# Filter for active threats only\nactive = [i for i in indicators if i[\"url_status\"] == \"online\"]\nprint(f\"Active threats: {len(active)}\")\n```\n\n**AlienVault OTX Pulse Feed:**\n\n```python\nfrom OTXv2 import OTXv2, IndicatorTypes\n\notx = OTXv2(\"YOUR_OTX_API_KEY\")\n\n# Get subscribed pulses (last 24 hours)\npulses = otx.getall(modified_since=\"2024-03-14T00:00:00\")\n\nfor pulse in pulses:\n    print(f\"Pulse: {pulse['name']}\")\n    print(f\"Tags: {pulse['tags']}\")\n    for indicator in pulse[\"indicators\"]:\n        print(f\"  IOC: {indicator['indicator']} ({indicator['type']})\")\n```\n\n**Abuse.ch Feodo Tracker (C2 IPs):**\n\n```python\nresponse = requests.get(\"https:\u002F\u002Ffeodotracker.abuse.ch\u002Fdownloads\u002Fipblocklist_recommended.json\")\nc2_data = response.json()\n\nfor entry in c2_data:\n    print(f\"IP: {entry['ip_address']}:{entry['port']}\")\n    print(f\"Malware: {entry['malware']}\")\n    print(f\"First Seen: {entry['first_seen']}\")\n    print(f\"Last Online: {entry['last_online']}\")\n```\n\n### Step 4: Normalize and Deduplicate\n\nConvert all feeds to STIX 2.1 format for standardization:\n\n```python\nfrom stix2 import Indicator, Bundle\nimport hashlib\n\ndef create_stix_indicator(ioc_value, ioc_type, source, confidence=50):\n    \"\"\"Convert raw IOC to STIX 2.1 indicator\"\"\"\n    pattern_map = {\n        \"ipv4\": f\"[ipv4-addr:value = '{ioc_value}']\",\n        \"domain\": f\"[domain-name:value = '{ioc_value}']\",\n        \"url\": f\"[url:value = '{ioc_value}']\",\n        \"sha256\": f\"[file:hashes.'SHA-256' = '{ioc_value}']\",\n        \"md5\": f\"[file:hashes.MD5 = '{ioc_value}']\",\n    }\n\n    return Indicator(\n        name=f\"{ioc_type}: {ioc_value}\",\n        pattern=pattern_map[ioc_type],\n        pattern_type=\"stix\",\n        valid_from=\"2024-03-15T00:00:00Z\",\n        confidence=confidence,\n        labels=[source],\n        custom_properties={\"x_source_feed\": source}\n    )\n\n# Deduplicate across sources\nseen_iocs = set()\nunique_indicators = []\n\nfor ioc in all_collected_iocs:\n    ioc_hash = hashlib.sha256(f\"{ioc['type']}:{ioc['value']}\".encode()).hexdigest()\n    if ioc_hash not in seen_iocs:\n        seen_iocs.add(ioc_hash)\n        unique_indicators.append(\n            create_stix_indicator(ioc[\"value\"], ioc[\"type\"], ioc[\"source\"])\n        )\n\nbundle = Bundle(objects=unique_indicators)\nprint(f\"Unique indicators: {len(unique_indicators)}\")\n```\n\n### Step 5: Push to SIEM Threat Intelligence Framework\n\n**Push to Splunk ES Threat Intelligence:**\n\n```python\nimport requests\n\nsplunk_url = \"https:\u002F\u002Fsplunk.company.com:8089\"\nheaders = {\"Authorization\": f\"Bearer {splunk_token}\"}\n\nfor indicator in unique_indicators:\n    # Extract IOC value from STIX pattern\n    ioc_value = indicator.pattern.split(\"'\")[1]\n\n    # Upload to Splunk ES threat intel collection\n    data = {\n        \"ip\": ioc_value,\n        \"description\": indicator.name,\n        \"weight\": indicator.confidence \u002F\u002F 10,\n        \"threat_key\": indicator.id,\n        \"source_feed\": indicator.get(\"x_source_feed\", \"unknown\")\n    }\n\n    requests.post(\n        f\"{splunk_url}\u002Fservices\u002Fdata\u002Fthreat_intel\u002Fitem\u002Fip_intel\",\n        headers=headers, data=data,\n        verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n    )\n```\n\n**Push to MISP for centralized management:**\n\n```python\nfrom pymisp import PyMISP, MISPEvent, MISPAttribute\n\nmisp = PyMISP(\"https:\u002F\u002Fmisp.company.com\", \"YOUR_MISP_API_KEY\")\n\n# Create event for feed batch\nevent = MISPEvent()\nevent.info = f\"TI Feed Import - {datetime.now().strftime('%Y-%m-%d')}\"\nevent.threat_level_id = 2  # Medium\nevent.analysis = 2  # Completed\n\n# Add indicators as attributes\nfor ioc in unique_indicators:\n    attr = MISPAttribute()\n    attr.type = \"ip-dst\" if \"ipv4\" in ioc.pattern else \"domain\"\n    attr.value = ioc.pattern.split(\"'\")[1]\n    attr.to_ids = True\n    attr.comment = f\"Source: {ioc.get('x_source_feed', 'mixed')}\"\n    event.add_attribute(**attr)\n\nresult = misp.add_event(event)\nprint(f\"MISP Event created: {result['Event']['id']}\")\n```\n\n### Step 6: Monitor Feed Health and Quality\n\nTrack feed effectiveness metrics:\n\n```spl\nindex=threat_intel sourcetype=\"threat_intel_manager\"\n| stats count AS total_iocs,\n        dc(threat_key) AS unique_iocs,\n        dc(source_feed) AS feed_count\n  by source_feed\n| join source_feed [\n    search index=notable source=\"Threat Intelligence\"\n    | stats count AS matches by source_feed\n  ]\n| eval match_rate = round(matches \u002F unique_iocs * 100, 2)\n| sort - match_rate\n| table source_feed, unique_iocs, matches, match_rate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — standardized JSON format for sharing threat intelligence objects |\n| **TAXII** | Trusted Automated eXchange of Indicator Information — transport protocol for sharing STIX data via REST API |\n| **TIP** | Threat Intelligence Platform — centralized system for aggregating, scoring, and distributing threat intelligence |\n| **IOC Scoring** | Process of assigning confidence values to indicators based on source reliability and corroboration |\n| **Feed Deduplication** | Removing duplicate IOCs across multiple sources while preserving multi-source attribution |\n| **IOC Expiration** | Time-to-live policy removing aged indicators (IP: 30 days, Domain: 90 days, Hash: 1 year) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence platform for feed aggregation, correlation, and sharing\n- **AlienVault OTX**: Free threat intelligence sharing platform with community pulse feeds\n- **Abuse.ch**: Suite of free threat feeds (URLhaus, MalwareBazaar, Feodo Tracker, ThreatFox)\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 native storage\n- **TAXII2 Client**: Python library for connecting to STIX\u002FTAXII 2.1 servers for automated indicator retrieval\n\n## Common Scenarios\n\n- **New Feed Onboarding**: Evaluate feed quality, map fields to STIX, configure automated ingestion pipeline\n- **Multi-SIEM Distribution**: Push normalized IOCs from MISP to Splunk, Elastic, and Sentinel simultaneously\n- **False Positive Reduction**: Score IOCs by source count and age, expire stale indicators automatically\n- **Feed Quality Audit**: Compare detection match rates across feeds to identify highest-value sources\n- **Incident IOC Sharing**: Package investigation IOCs as STIX bundle and share with ISACs via TAXII\n\n## Output Format\n\n```\nTHREAT INTEL FEED STATUS — Daily Report\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-15\nTotal IOCs:   45,892 active indicators\n\nFeed Health:\n  Feed                  IOCs    Matches  Match Rate  Status\n  Abuse.ch URLhaus      12,340  47       0.38%       HEALTHY\n  AlienVault OTX        18,567  23       0.12%       HEALTHY\n  Abuse.ch Feodo        1,203   12       1.00%       HEALTHY\n  CISA AIS              8,945   8        0.09%       HEALTHY\n  CrowdStrike Intel     4,837   31       0.64%       HEALTHY\n\nActions Today:\n  New IOCs ingested:    1,247\n  IOCs expired:         892\n  Duplicates removed:   156\n  SIEM matches:         121 notable events generated\n  False positives:      3 (CDN IPs removed from feed)\n```\n",{"name":5,"tags":46,"author":49,"domain":40,"license":15,"version":50,"nist_csf":51,"subdomain":56,"description":57,"mitre_attack":58},[32,27,33,47,48,28,34,29],"taxii","misp","mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Builds automated threat intelligence feed integration pipelines connecting STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.\n",[59,60,61],"T1071","T1105","T1588.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-threat-intelligence-feed-integration",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-threat-intelligence-feed-integration",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-threat-intelligence-feed-integration",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-threat-intelligence-feed-integration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002FSKILL.md",true,[86,92,97,101],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"agents\u002Fopenai.yaml","REFERENCE","参考文档",113,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgrilling\u002Fagents\u002Fopenai.yaml",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002FLICENSE",{"path":98,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md",2187,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",6391,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002Fscripts\u002Fagent.py",[108,134,158,186,212,239],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,35,40,120,121,122,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,35,145,40,122,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,169,170,171,172,40,173,174,146,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,40,197,198,199,200,201,202,203,204,205,206,207,208,149,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,40,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,247,40,39,248,34,32,249,250,251,252,181,253,182,254,255,256,257,258,259],"triaging security incident","file","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]