[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFJAMW0XRZWJMRB6DQ1FCH":3,"skill-same:01M6AFJAMW0XRZWJMRB6DQ1FCH":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6AFJAMW0XRZWJMRB6DQ1FCH","operationalizing-misp-threat-feeds",null,"Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata\u002FSigma\u002FWazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM\u002FIDS.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperationalizing-misp-threat-feeds\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"feeds","operationalizing misp threat feeds","MISP","engineering","threat-intelligence","ioc","cache","detection-engineering","sigma","cybersecurity","Wazuh","ids","suricata","detection","indicators","pymisp","threat-feeds","siem","2026-11-10 10:12:30",false,"---\nname: operationalizing-misp-threat-feeds\ndescription: Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata\u002FSigma\u002FWazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM\u002FIDS.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- misp\n- pymisp\n- threat-feeds\n- ioc\n- suricata\n- sigma\n- detection-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-02\nmitre_attack:\n- T1589\n---\n# Operationalizing MISP Threat Feeds\n\n> **Note:** This skill covers a defensive threat-intelligence platform. Handle ingested intelligence according to its Traffic Light Protocol (TLP) marking and your sharing agreements. Treat ingested IOCs as potentially sensitive.\n\n## Overview\n\nMISP (Malware Information Sharing Platform) is the de-facto open-source threat-intelligence platform for storing, correlating, and sharing structured indicators (IOCs), events, galaxies (threat-actor\u002Ftechnique knowledge), and objects. Running a MISP instance is only the first step; the value comes from *operationalizing* it — curating high-quality feeds, suppressing false positives with warninglists, and pushing the resulting IOCs into detection tooling so intelligence actually drives blocking and alerting.\n\nA feed in MISP is a remote source (another MISP, a CSV\u002Ffreetext list, or a structured collection) that you **enable** and optionally **cache**. Caching pulls the feed's IOCs into the instance's Redis-backed cache so values can be correlated and looked up in real time (e.g., a SIEM asking \"have you seen this domain?\") without importing every event. Curation matters: enabling every public feed produces noise and false positives, so you select reputable feeds (CIRCL OSINT, abuse.ch, Feodo Tracker, etc.), apply **warninglists** (known-good ranges like RFC1918, Alexa\u002FTranco top sites, public DNS resolvers) to flag non-actionable indicators, and use taxonomies\u002Ftags (TLP, confidence) to scope what gets exported.\n\nThe detection-engineering payoff comes from MISP's export formats and PyMISP. MISP can render matching attributes directly as **Suricata** and **Snort** rules via the REST API, and PyMISP lets you script extraction of fresh IOCs to generate **Sigma** rules and **Wazuh** CDB lists \u002F rules on a schedule. This skill walks the full lifecycle: feed enablement and caching, warninglist-based FP reduction, PyMISP-driven search, and automated generation of Suricata, Sigma, and Wazuh detections.\n\n## When to Use\n\n- Standing up or maturing a MISP instance into a feed that drives detection, not just a repository.\n- Curating and caching public\u002Fcommercial threat feeds with quality controls.\n- Reducing IOC false positives with warninglists before they reach the SIEM\u002FIDS.\n- Automating generation of Suricata\u002FSigma\u002FWazuh detections from MISP attributes.\n- Integrating MISP with a SOC so DNS\u002FIP\u002Fhash lookups can be enriched against current intel.\n\n## Prerequisites\n\n- A running MISP instance (the maintained container images are the fastest path):\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002FMISP\u002Fmisp-docker.git\n  cd misp-docker && cp template.env .env\n  docker compose up -d\n  # Web UI on https:\u002F\u002Flocalhost; default admin: admin@admin.test \u002F admin\n  ```\n- A MISP **Auth Key** (UI: Administration -> List Auth Keys -> Add).\n- PyMISP:\n  ```bash\n  pip install pymisp\n  ```\n- Target detection tooling reachable: Suricata, a Sigma toolchain (`pip install sigma-cli`), and\u002For Wazuh manager.\n\n## Objectives\n\n- Enable and cache curated threat feeds in MISP.\n- Apply warninglists to suppress known-good \u002F non-actionable indicators.\n- Authenticate and query MISP with PyMISP to pull fresh, scoped IOCs.\n- Export matching attributes as Suricata\u002FSnort rules via the REST API.\n- Generate Sigma rules and Wazuh CDB lists from MISP attributes on a schedule.\n- Validate that generated detections load and fire in the target tooling.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | Relevance |\n|--------------|----------------|-----------|\n| T1589 | Gather Victim Identity Information | Feeds capture adversary reconnaissance indicators; operationalizing them detects\u002Fcontextualizes such activity. |\n| T1071.001 | Application Layer Protocol: Web Protocols | C2 domain\u002FURL IOCs from feeds become Suricata\u002FSigma detections for malicious HTTP(S). |\n| T1071.004 | Application Layer Protocol: DNS | Malicious-domain IOCs feed DNS-based detection (Wazuh\u002FSuricata). |\n| T1105 | Ingress Tool Transfer | File-hash IOCs from feeds detect known malicious payload delivery. |\n\n## Workflow\n\n### 1. Add and enable a feed\nRegister a reputable source and turn it on.\n```python\n# add_feed.py (PyMISP) — register the CIRCL OSINT feed\nfrom pymisp import PyMISP, MISPFeed\nmisp = PyMISP(\"https:\u002F\u002Flocalhost\", \"YOUR_AUTH_KEY\", ssl=False)\nfeed = MISPFeed()\nfeed.name = \"CIRCL OSINT Feed\"\nfeed.provider = \"CIRCL\"\nfeed.url = \"https:\u002F\u002Fwww.circl.lu\u002Fdoc\u002Fmisp\u002Ffeed-osint\"\nfeed.source_format = \"misp\"\nfeed.input_source = \"network\"\nfeed.enabled = True\nprint(misp.add_feed(feed, pythonify=True))\n```\n\n### 2. Cache enabled feeds for real-time correlation\nCaching loads feed IOCs into Redis so lookups are instant.\n```python\n# Cache all enabled feeds (equivalent to \"Enable caching\" in the UI)\nprint(misp.cache_all_feeds())\n# Or fetch a single feed's events into the instance by feed id:\nprint(misp.fetch_feed(1))\n```\n\n### 3. Enable warninglists to reduce false positives\nTurn on known-good lists so non-actionable indicators are flagged.\n```python\n# Enable the common false-positive warninglists\nfor wl in misp.warninglists(pythonify=True):\n    if wl.name in (\"List of RFC 1918 CIDR blocks\",\n                   \"Top 1000 website from Cisco Umbrella\",\n                   \"List of known public DNS resolvers\"):\n        misp.toggle_warninglist(warninglist_id=wl.id, force_enable=True)\n```\n\n### 4. Authenticate and search for fresh IOCs\nPull recently published, TLP-scoped, to-IDS attributes only.\n```python\nfrom pymisp import PyMISP\nmisp = PyMISP(\"https:\u002F\u002Flocalhost\", \"YOUR_AUTH_KEY\", ssl=False)\n# Only export attributes flagged to_ids=1, published, last 7 days, IP\u002Fdomain\u002Furl\u002Fhash\nattrs = misp.search(\n    controller=\"attributes\",\n    type_attribute=[\"ip-dst\", \"domain\", \"url\", \"md5\", \"sha256\"],\n    to_ids=True, published=True, last=\"7d\",\n    enforce_warninglist=True,   # drop warninglisted (known-good) values\n    pythonify=True,\n)\nprint(f\"{len(attrs)} actionable IOCs\")\n```\n\n### 5. Export Suricata\u002FSnort rules via the REST API\nMISP renders matching attributes directly as IDS rules.\n```bash\n# Suricata rules for all to_ids network IOCs (NIDS export)\ncurl -s -k -H \"Authorization: YOUR_AUTH_KEY\" -H \"Accept: application\u002Fjson\" \\\n  \"https:\u002F\u002Flocalhost\u002Fattributes\u002FrestSearch\u002FreturnFormat:suricata\u002Fto_ids:1\u002Ftype:domain%7Cip-dst%7Curl\" \\\n  -o misp_suricata.rules\n\n# Snort equivalent\ncurl -s -k -H \"Authorization: YOUR_AUTH_KEY\" -H \"Accept: application\u002Fjson\" \\\n  \"https:\u002F\u002Flocalhost\u002Fattributes\u002FrestSearch\u002FreturnFormat:snort\u002Fto_ids:1\" -o misp_snort.rules\n```\n\n### 6. Deploy the Suricata rules\nLoad and reload.\n```bash\ncp misp_suricata.rules \u002Fetc\u002Fsuricata\u002Frules\u002F\nsuricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml   # validate config + rules\nsuricatasc -c reload-rules                    # hot reload\n```\n\n### 7. Generate Wazuh CDB lists from IOCs\nConvert MISP domains\u002FIPs into a Wazuh CDB lookup list referenced by a rule.\n```python\n# Build a Wazuh CDB list (key:value per line) from the searched attributes\nwith open(\"misp_iocs.cdb\", \"w\") as fh:\n    for a in attrs:\n        if a.type in (\"domain\", \"ip-dst\"):\n            fh.write(f\"{a.value}:\\n\")\n# On the Wazuh manager: place under \u002Fvar\u002Fossec\u002Fetc\u002Flists\u002F, reference in ossec.conf:\n#   \u003Clist>etc\u002Flists\u002Fmisp_iocs\u003C\u002Flist>\n# then compile and restart:\n#   \u002Fvar\u002Fossec\u002Fbin\u002Fwazuh-control restart\n```\n\n### 8. Generate Sigma rules from MISP intelligence\nEmit a Sigma rule matching the exported domains.\n```python\nimport yaml\ndomains = [a.value for a in attrs if a.type == \"domain\"]\nsigma = {\n    \"title\": \"MISP feed malicious domain contact\",\n    \"status\": \"experimental\",\n    \"logsource\": {\"category\": \"dns\"},\n    \"detection\": {\"selection\": {\"query|contains\": domains}, \"condition\": \"selection\"},\n    \"level\": \"high\",\n    \"tags\": [\"attack.command_and_control\", \"attack.t1071.004\"],\n}\nwith open(\"misp_domains.yml\", \"w\") as fh:\n    yaml.safe_dump(sigma, fh, sort_keys=False)\n```\n\n### 9. Convert and deploy Sigma to your SIEM backend\nUse `sigma-cli` to compile to the target backend (Splunk, Elastic, etc.).\n```bash\nsigma convert -t splunk -p splunk_windows misp_domains.yml > misp_domains.spl\nsigma convert -t elasticsearch misp_domains.yml > misp_domains.eql\n```\n\n### 10. Schedule the pipeline and run the bundled helper\n`agent.py` searches MISP and writes Suricata\u002FSigma\u002FWazuh artifacts in one pass; schedule it via cron.\n```bash\npython scripts\u002Fagent.py --url https:\u002F\u002Flocalhost --key YOUR_AUTH_KEY \\\n  --last 7d --outdir .\u002Fdetections --insecure\n# crontab: 0 * * * * \u002Fusr\u002Fbin\u002Fpython \u002Fpath\u002Fscripts\u002Fagent.py ... >> \u002Fvar\u002Flog\u002Fmisp_pipeline.log 2>&1\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| MISP | Threat-intelligence platform | https:\u002F\u002Fwww.misp-project.org\u002F |\n| misp-docker | Maintained container deployment | https:\u002F\u002Fgithub.com\u002FMISP\u002Fmisp-docker |\n| PyMISP | Python client for the MISP REST API | https:\u002F\u002Fgithub.com\u002FMISP\u002FPyMISP |\n| MISP warninglists | Known-good lists for FP reduction | https:\u002F\u002Fgithub.com\u002FMISP\u002Fmisp-warninglists |\n| MISP automation docs | REST API + export formats | https:\u002F\u002Fwww.circl.lu\u002Fdoc\u002Fmisp\u002Fautomation\u002F |\n| sigma-cli | Sigma rule conversion | https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma-cli |\n| Wazuh CDB lists | IOC lookup lists for Wazuh | https:\u002F\u002Fdocumentation.wazuh.com\u002F |\n\n## Validation Criteria\n\n- [ ] MISP instance reachable and an Auth Key created.\n- [ ] At least one reputable feed enabled and cached.\n- [ ] Relevant warninglists enabled and `enforce_warninglist` applied to searches.\n- [ ] PyMISP search returns scoped, to_ids, non-warninglisted IOCs.\n- [ ] Suricata\u002FSnort rules exported via REST and validated with `suricata -T`.\n- [ ] Wazuh CDB list generated and loaded by the manager.\n- [ ] Sigma rule generated and converted to the SIEM backend.\n- [ ] Generated detections confirmed to load (and fire on a test IOC).\n- [ ] Pipeline scheduled and logging successfully.\n","# Operationalizing MISP Threat Feeds\n\n> **Note:** This skill covers a defensive threat-intelligence platform. Handle ingested intelligence according to its Traffic Light Protocol (TLP) marking and your sharing agreements. Treat ingested IOCs as potentially sensitive.\n\n## Overview\n\nMISP (Malware Information Sharing Platform) is the de-facto open-source threat-intelligence platform for storing, correlating, and sharing structured indicators (IOCs), events, galaxies (threat-actor\u002Ftechnique knowledge), and objects. Running a MISP instance is only the first step; the value comes from *operationalizing* it — curating high-quality feeds, suppressing false positives with warninglists, and pushing the resulting IOCs into detection tooling so intelligence actually drives blocking and alerting.\n\nA feed in MISP is a remote source (another MISP, a CSV\u002Ffreetext list, or a structured collection) that you **enable** and optionally **cache**. Caching pulls the feed's IOCs into the instance's Redis-backed cache so values can be correlated and looked up in real time (e.g., a SIEM asking \"have you seen this domain?\") without importing every event. Curation matters: enabling every public feed produces noise and false positives, so you select reputable feeds (CIRCL OSINT, abuse.ch, Feodo Tracker, etc.), apply **warninglists** (known-good ranges like RFC1918, Alexa\u002FTranco top sites, public DNS resolvers) to flag non-actionable indicators, and use taxonomies\u002Ftags (TLP, confidence) to scope what gets exported.\n\nThe detection-engineering payoff comes from MISP's export formats and PyMISP. MISP can render matching attributes directly as **Suricata** and **Snort** rules via the REST API, and PyMISP lets you script extraction of fresh IOCs to generate **Sigma** rules and **Wazuh** CDB lists \u002F rules on a schedule. This skill walks the full lifecycle: feed enablement and caching, warninglist-based FP reduction, PyMISP-driven search, and automated generation of Suricata, Sigma, and Wazuh detections.\n\n## When to Use\n\n- Standing up or maturing a MISP instance into a feed that drives detection, not just a repository.\n- Curating and caching public\u002Fcommercial threat feeds with quality controls.\n- Reducing IOC false positives with warninglists before they reach the SIEM\u002FIDS.\n- Automating generation of Suricata\u002FSigma\u002FWazuh detections from MISP attributes.\n- Integrating MISP with a SOC so DNS\u002FIP\u002Fhash lookups can be enriched against current intel.\n\n## Prerequisites\n\n- A running MISP instance (the maintained container images are the fastest path):\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002FMISP\u002Fmisp-docker.git\n  cd misp-docker && cp template.env .env\n  docker compose up -d\n  # Web UI on https:\u002F\u002Flocalhost; default admin: admin@admin.test \u002F admin\n  ```\n- A MISP **Auth Key** (UI: Administration -> List Auth Keys -> Add).\n- PyMISP:\n  ```bash\n  pip install pymisp\n  ```\n- Target detection tooling reachable: Suricata, a Sigma toolchain (`pip install sigma-cli`), and\u002For Wazuh manager.\n\n## Objectives\n\n- Enable and cache curated threat feeds in MISP.\n- Apply warninglists to suppress known-good \u002F non-actionable indicators.\n- Authenticate and query MISP with PyMISP to pull fresh, scoped IOCs.\n- Export matching attributes as Suricata\u002FSnort rules via the REST API.\n- Generate Sigma rules and Wazuh CDB lists from MISP attributes on a schedule.\n- Validate that generated detections load and fire in the target tooling.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | Relevance |\n|--------------|----------------|-----------|\n| T1589 | Gather Victim Identity Information | Feeds capture adversary reconnaissance indicators; operationalizing them detects\u002Fcontextualizes such activity. |\n| T1071.001 | Application Layer Protocol: Web Protocols | C2 domain\u002FURL IOCs from feeds become Suricata\u002FSigma detections for malicious HTTP(S). |\n| T1071.004 | Application Layer Protocol: DNS | Malicious-domain IOCs feed DNS-based detection (Wazuh\u002FSuricata). |\n| T1105 | Ingress Tool Transfer | File-hash IOCs from feeds detect known malicious payload delivery. |\n\n## Workflow\n\n### 1. Add and enable a feed\nRegister a reputable source and turn it on.\n```python\n# add_feed.py (PyMISP) — register the CIRCL OSINT feed\nfrom pymisp import PyMISP, MISPFeed\nmisp = PyMISP(\"https:\u002F\u002Flocalhost\", \"YOUR_AUTH_KEY\", ssl=False)\nfeed = MISPFeed()\nfeed.name = \"CIRCL OSINT Feed\"\nfeed.provider = \"CIRCL\"\nfeed.url = \"https:\u002F\u002Fwww.circl.lu\u002Fdoc\u002Fmisp\u002Ffeed-osint\"\nfeed.source_format = \"misp\"\nfeed.input_source = \"network\"\nfeed.enabled = True\nprint(misp.add_feed(feed, pythonify=True))\n```\n\n### 2. Cache enabled feeds for real-time correlation\nCaching loads feed IOCs into Redis so lookups are instant.\n```python\n# Cache all enabled feeds (equivalent to \"Enable caching\" in the UI)\nprint(misp.cache_all_feeds())\n# Or fetch a single feed's events into the instance by feed id:\nprint(misp.fetch_feed(1))\n```\n\n### 3. Enable warninglists to reduce false positives\nTurn on known-good lists so non-actionable indicators are flagged.\n```python\n# Enable the common false-positive warninglists\nfor wl in misp.warninglists(pythonify=True):\n    if wl.name in (\"List of RFC 1918 CIDR blocks\",\n                   \"Top 1000 website from Cisco Umbrella\",\n                   \"List of known public DNS resolvers\"):\n        misp.toggle_warninglist(warninglist_id=wl.id, force_enable=True)\n```\n\n### 4. Authenticate and search for fresh IOCs\nPull recently published, TLP-scoped, to-IDS attributes only.\n```python\nfrom pymisp import PyMISP\nmisp = PyMISP(\"https:\u002F\u002Flocalhost\", \"YOUR_AUTH_KEY\", ssl=False)\n# Only export attributes flagged to_ids=1, published, last 7 days, IP\u002Fdomain\u002Furl\u002Fhash\nattrs = misp.search(\n    controller=\"attributes\",\n    type_attribute=[\"ip-dst\", \"domain\", \"url\", \"md5\", \"sha256\"],\n    to_ids=True, published=True, last=\"7d\",\n    enforce_warninglist=True,   # drop warninglisted (known-good) values\n    pythonify=True,\n)\nprint(f\"{len(attrs)} actionable IOCs\")\n```\n\n### 5. Export Suricata\u002FSnort rules via the REST API\nMISP renders matching attributes directly as IDS rules.\n```bash\n# Suricata rules for all to_ids network IOCs (NIDS export)\ncurl -s -k -H \"Authorization: YOUR_AUTH_KEY\" -H \"Accept: application\u002Fjson\" \\\n  \"https:\u002F\u002Flocalhost\u002Fattributes\u002FrestSearch\u002FreturnFormat:suricata\u002Fto_ids:1\u002Ftype:domain%7Cip-dst%7Curl\" \\\n  -o misp_suricata.rules\n\n# Snort equivalent\ncurl -s -k -H \"Authorization: YOUR_AUTH_KEY\" -H \"Accept: application\u002Fjson\" \\\n  \"https:\u002F\u002Flocalhost\u002Fattributes\u002FrestSearch\u002FreturnFormat:snort\u002Fto_ids:1\" -o misp_snort.rules\n```\n\n### 6. Deploy the Suricata rules\nLoad and reload.\n```bash\ncp misp_suricata.rules \u002Fetc\u002Fsuricata\u002Frules\u002F\nsuricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml   # validate config + rules\nsuricatasc -c reload-rules                    # hot reload\n```\n\n### 7. Generate Wazuh CDB lists from IOCs\nConvert MISP domains\u002FIPs into a Wazuh CDB lookup list referenced by a rule.\n```python\n# Build a Wazuh CDB list (key:value per line) from the searched attributes\nwith open(\"misp_iocs.cdb\", \"w\") as fh:\n    for a in attrs:\n        if a.type in (\"domain\", \"ip-dst\"):\n            fh.write(f\"{a.value}:\\n\")\n# On the Wazuh manager: place under \u002Fvar\u002Fossec\u002Fetc\u002Flists\u002F, reference in ossec.conf:\n#   \u003Clist>etc\u002Flists\u002Fmisp_iocs\u003C\u002Flist>\n# then compile and restart:\n#   \u002Fvar\u002Fossec\u002Fbin\u002Fwazuh-control restart\n```\n\n### 8. Generate Sigma rules from MISP intelligence\nEmit a Sigma rule matching the exported domains.\n```python\nimport yaml\ndomains = [a.value for a in attrs if a.type == \"domain\"]\nsigma = {\n    \"title\": \"MISP feed malicious domain contact\",\n    \"status\": \"experimental\",\n    \"logsource\": {\"category\": \"dns\"},\n    \"detection\": {\"selection\": {\"query|contains\": domains}, \"condition\": \"selection\"},\n    \"level\": \"high\",\n    \"tags\": [\"attack.command_and_control\", \"attack.t1071.004\"],\n}\nwith open(\"misp_domains.yml\", \"w\") as fh:\n    yaml.safe_dump(sigma, fh, sort_keys=False)\n```\n\n### 9. Convert and deploy Sigma to your SIEM backend\nUse `sigma-cli` to compile to the target backend (Splunk, Elastic, etc.).\n```bash\nsigma convert -t splunk -p splunk_windows misp_domains.yml > misp_domains.spl\nsigma convert -t elasticsearch misp_domains.yml > misp_domains.eql\n```\n\n### 10. Schedule the pipeline and run the bundled helper\n`agent.py` searches MISP and writes Suricata\u002FSigma\u002FWazuh artifacts in one pass; schedule it via cron.\n```bash\npython scripts\u002Fagent.py --url https:\u002F\u002Flocalhost --key YOUR_AUTH_KEY \\\n  --last 7d --outdir .\u002Fdetections --insecure\n# crontab: 0 * * * * \u002Fusr\u002Fbin\u002Fpython \u002Fpath\u002Fscripts\u002Fagent.py ... >> \u002Fvar\u002Flog\u002Fmisp_pipeline.log 2>&1\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| MISP | Threat-intelligence platform | https:\u002F\u002Fwww.misp-project.org\u002F |\n| misp-docker | Maintained container deployment | https:\u002F\u002Fgithub.com\u002FMISP\u002Fmisp-docker |\n| PyMISP | Python client for the MISP REST API | https:\u002F\u002Fgithub.com\u002FMISP\u002FPyMISP |\n| MISP warninglists | Known-good lists for FP reduction | https:\u002F\u002Fgithub.com\u002FMISP\u002Fmisp-warninglists |\n| MISP automation docs | REST API + export formats | https:\u002F\u002Fwww.circl.lu\u002Fdoc\u002Fmisp\u002Fautomation\u002F |\n| sigma-cli | Sigma rule conversion | https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma-cli |\n| Wazuh CDB lists | IOC lookup lists for Wazuh | https:\u002F\u002Fdocumentation.wazuh.com\u002F |\n\n## Validation Criteria\n\n- [ ] MISP instance reachable and an Auth Key created.\n- [ ] At least one reputable feed enabled and cached.\n- [ ] Relevant warninglists enabled and `enforce_warninglist` applied to searches.\n- [ ] PyMISP search returns scoped, to_ids, non-warninglisted IOCs.\n- [ ] Suricata\u002FSnort rules exported via REST and validated with `suricata -T`.\n- [ ] Wazuh CDB list generated and loaded by the manager.\n- [ ] Sigma rule generated and converted to the SIEM backend.\n- [ ] Generated detections confirmed to load (and fire on a test IOC).\n- [ ] Pipeline scheduled and logging successfully.\n",{"name":5,"tags":50,"author":52,"domain":36,"license":15,"version":53,"nist_csf":54,"subdomain":31,"description":7,"mitre_attack":56},[31,51,42,43,32,39,35,34],"misp","mahipal","1.0",[55],"ID.RA-02",[57],"T1589","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Foperationalizing-misp-threat-feeds",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill operationalizing-misp-threat-feeds",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill operationalizing-misp-threat-feeds",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill operationalizing-misp-threat-feeds","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperationalizing-misp-threat-feeds\u002FSKILL.md",true,[82,87,93,97],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperationalizing-misp-threat-feeds\u002FLICENSE",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fapi-reference.md","REFERENCE","参考文档",2410,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperationalizing-misp-threat-feeds\u002Freferences\u002Fapi-reference.md",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fstandards.md",1573,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperationalizing-misp-threat-feeds\u002Freferences\u002Fstandards.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",4833,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Foperationalizing-misp-threat-feeds\u002Fscripts\u002Fagent.py",[104,131,155,182,208,235],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":45},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,116,36,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":45},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,116,142,36,119,143,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":45},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,36,170,171,143,172,173,174,175,176,40,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":45},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,36,193,194,195,196,197,198,199,200,201,202,203,204,146,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":45},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,36,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":45},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[241],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[116,243,36,44,244,32,245,246,247,248,249,177,250,178,251,252,253,254,255,256],"triaging security incident","file","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]