[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFVA85NT735R9Z3TQ1FDJ0":3,"skill-same:01M6AFVA85NT735R9Z3TQ1FDJ0":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AFVA85NT735R9Z3TQ1FDJ0","performing-ioc-enrichment-automation",null,"Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ioc-enrichment-automation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"performing ioc enrichment automation","automation","ioc","enrichment","AbuseIPDB","investigation","t1566","t1078","ips","Shodan","indicator","MISP","cybersecurity","VirusTotal","soc","threat-intelligence","file","alert triage","triage","2026-11-10 10:12:30",false,"---\nname: performing-ioc-enrichment-automation\ndescription: 'Automates Indicator of Compromise (IOC) enrichment by orchestrating\n  lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources\n  to provide contextual scoring and disposition recommendations. Use when SOC analysts\n  need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during\n  alert triage or incident investigation.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- ioc\n- enrichment\n- automation\n- virustotal\n- abuseipdb\n- shodan\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n---\n# Performing IOC Enrichment Automation\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to quickly enrich IOCs from multiple sources during alert triage\n- High alert volumes require automated enrichment to reduce manual lookup time\n- Incident investigations need comprehensive IOC context for scope assessment\n- SOAR playbooks require enrichment actions as part of automated triage workflows\n\n**Do not use** for bulk blocking decisions without analyst review — enrichment provides context, not definitive malicious\u002Fbenign determination.\n\n## Prerequisites\n\n- API keys: VirusTotal (free or premium), AbuseIPDB, Shodan, URLScan.io, GreyNoise\n- Python 3.8+ with `requests`, `vt-py`, `shodan` libraries\n- MISP instance or TIP for cross-referencing organizational intelligence\n- SOAR platform (optional) for workflow integration\n- Rate limit awareness: VT free (4 req\u002Fmin), AbuseIPDB (1000\u002Fday), Shodan (1 req\u002Fsec)\n\n## Workflow\n\n### Step 1: Build Unified Enrichment Engine\n\nCreate a multi-source enrichment pipeline:\n\n```python\nimport requests\nimport vt\nimport shodan\nimport time\nfrom dataclasses import dataclass, field\nfrom typing import Optional\n\n@dataclass\nclass EnrichmentResult:\n    ioc_value: str\n    ioc_type: str\n    virustotal: dict = field(default_factory=dict)\n    abuseipdb: dict = field(default_factory=dict)\n    shodan_data: dict = field(default_factory=dict)\n    greynoise: dict = field(default_factory=dict)\n    urlscan: dict = field(default_factory=dict)\n    misp_matches: list = field(default_factory=list)\n    risk_score: float = 0.0\n    disposition: str = \"Unknown\"\n\nclass IOCEnrichmentEngine:\n    def __init__(self, config):\n        self.vt_client = vt.Client(config[\"virustotal_key\"])\n        self.shodan_api = shodan.Shodan(config[\"shodan_key\"])\n        self.abuseipdb_key = config[\"abuseipdb_key\"]\n        self.greynoise_key = config[\"greynoise_key\"]\n        self.urlscan_key = config[\"urlscan_key\"]\n\n    def enrich_ip(self, ip_address):\n        result = EnrichmentResult(ioc_value=ip_address, ioc_type=\"ip\")\n\n        # VirusTotal\n        try:\n            vt_obj = self.vt_client.get_object(f\"\u002Fip_addresses\u002F{ip_address}\")\n            result.virustotal = {\n                \"malicious\": vt_obj.last_analysis_stats.get(\"malicious\", 0),\n                \"suspicious\": vt_obj.last_analysis_stats.get(\"suspicious\", 0),\n                \"total_engines\": sum(vt_obj.last_analysis_stats.values()),\n                \"reputation\": vt_obj.reputation,\n                \"country\": getattr(vt_obj, \"country\", \"Unknown\"),\n                \"as_owner\": getattr(vt_obj, \"as_owner\", \"Unknown\")\n            }\n        except Exception as e:\n            result.virustotal = {\"error\": str(e)}\n\n        # AbuseIPDB\n        try:\n            response = requests.get(\n                \"https:\u002F\u002Fapi.abuseipdb.com\u002Fapi\u002Fv2\u002Fcheck\",\n                headers={\"Key\": self.abuseipdb_key, \"Accept\": \"application\u002Fjson\"},\n                params={\"ipAddress\": ip_address, \"maxAgeInDays\": 90}\n            )\n            data = response.json()[\"data\"]\n            result.abuseipdb = {\n                \"confidence_score\": data[\"abuseConfidenceScore\"],\n                \"total_reports\": data[\"totalReports\"],\n                \"is_tor\": data.get(\"isTor\", False),\n                \"usage_type\": data.get(\"usageType\", \"Unknown\"),\n                \"isp\": data.get(\"isp\", \"Unknown\"),\n                \"domain\": data.get(\"domain\", \"Unknown\")\n            }\n        except Exception as e:\n            result.abuseipdb = {\"error\": str(e)}\n\n        # Shodan\n        try:\n            host = self.shodan_api.host(ip_address)\n            result.shodan_data = {\n                \"ports\": host.get(\"ports\", []),\n                \"os\": host.get(\"os\", \"Unknown\"),\n                \"organization\": host.get(\"org\", \"Unknown\"),\n                \"isp\": host.get(\"isp\", \"Unknown\"),\n                \"vulns\": host.get(\"vulns\", []),\n                \"last_update\": host.get(\"last_update\", \"Unknown\")\n            }\n        except shodan.APIError:\n            result.shodan_data = {\"status\": \"Not found in Shodan\"}\n\n        # GreyNoise\n        try:\n            response = requests.get(\n                f\"https:\u002F\u002Fapi.greynoise.io\u002Fv3\u002Fcommunity\u002F{ip_address}\",\n                headers={\"key\": self.greynoise_key}\n            )\n            gn_data = response.json()\n            result.greynoise = {\n                \"classification\": gn_data.get(\"classification\", \"unknown\"),\n                \"noise\": gn_data.get(\"noise\", False),\n                \"riot\": gn_data.get(\"riot\", False),\n                \"name\": gn_data.get(\"name\", \"Unknown\")\n            }\n        except Exception as e:\n            result.greynoise = {\"error\": str(e)}\n\n        # Calculate composite risk score\n        result.risk_score = self._calculate_ip_risk(result)\n        result.disposition = self._determine_disposition(result.risk_score)\n        return result\n\n    def enrich_domain(self, domain):\n        result = EnrichmentResult(ioc_value=domain, ioc_type=\"domain\")\n\n        # VirusTotal\n        try:\n            vt_obj = self.vt_client.get_object(f\"\u002Fdomains\u002F{domain}\")\n            result.virustotal = {\n                \"malicious\": vt_obj.last_analysis_stats.get(\"malicious\", 0),\n                \"suspicious\": vt_obj.last_analysis_stats.get(\"suspicious\", 0),\n                \"reputation\": vt_obj.reputation,\n                \"creation_date\": getattr(vt_obj, \"creation_date\", \"Unknown\"),\n                \"registrar\": getattr(vt_obj, \"registrar\", \"Unknown\"),\n                \"categories\": getattr(vt_obj, \"categories\", {})\n            }\n        except Exception as e:\n            result.virustotal = {\"error\": str(e)}\n\n        # URLScan.io\n        try:\n            response = requests.get(\n                f\"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fsearch\u002F?q=domain:{domain}\",\n                headers={\"API-Key\": self.urlscan_key}\n            )\n            scans = response.json().get(\"results\", [])\n            result.urlscan = {\n                \"total_scans\": len(scans),\n                \"verdicts\": [s.get(\"verdicts\", {}).get(\"overall\", {}).get(\"malicious\", False)\n                            for s in scans[:5]],\n                \"last_scan\": scans[0][\"task\"][\"time\"] if scans else \"Never scanned\"\n            }\n        except Exception as e:\n            result.urlscan = {\"error\": str(e)}\n\n        result.risk_score = self._calculate_domain_risk(result)\n        result.disposition = self._determine_disposition(result.risk_score)\n        return result\n\n    def enrich_hash(self, file_hash):\n        result = EnrichmentResult(ioc_value=file_hash, ioc_type=\"hash\")\n\n        # VirusTotal\n        try:\n            vt_obj = self.vt_client.get_object(f\"\u002Ffiles\u002F{file_hash}\")\n            result.virustotal = {\n                \"malicious\": vt_obj.last_analysis_stats.get(\"malicious\", 0),\n                \"suspicious\": vt_obj.last_analysis_stats.get(\"suspicious\", 0),\n                \"undetected\": vt_obj.last_analysis_stats.get(\"undetected\", 0),\n                \"total_engines\": sum(vt_obj.last_analysis_stats.values()),\n                \"type_description\": getattr(vt_obj, \"type_description\", \"Unknown\"),\n                \"popular_threat_name\": getattr(vt_obj, \"popular_threat_classification\", {}).get(\n                    \"suggested_threat_label\", \"Unknown\"\n                ),\n                \"sandbox_verdicts\": getattr(vt_obj, \"sandbox_verdicts\", {}),\n                \"first_seen\": getattr(vt_obj, \"first_submission_date\", \"Unknown\")\n            }\n        except vt.APIError:\n            result.virustotal = {\"status\": \"Not found in VirusTotal\"}\n\n        # MalwareBazaar\n        try:\n            response = requests.post(\n                \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n                data={\"query\": \"get_info\", \"hash\": file_hash}\n            )\n            mb_data = response.json()\n            if mb_data[\"query_status\"] == \"ok\":\n                entry = mb_data[\"data\"][0]\n                result.abuseipdb = {  # Reusing field for MalwareBazaar data\n                    \"malware_family\": entry.get(\"signature\", \"Unknown\"),\n                    \"tags\": entry.get(\"tags\", []),\n                    \"file_type\": entry.get(\"file_type\", \"Unknown\"),\n                    \"delivery_method\": entry.get(\"delivery_method\", \"Unknown\"),\n                    \"first_seen\": entry.get(\"first_seen\", \"Unknown\")\n                }\n        except Exception:\n            pass\n\n        result.risk_score = self._calculate_hash_risk(result)\n        result.disposition = self._determine_disposition(result.risk_score)\n        return result\n\n    def _calculate_ip_risk(self, result):\n        score = 0\n        vt = result.virustotal\n        abuse = result.abuseipdb\n        gn = result.greynoise\n\n        if isinstance(vt, dict) and \"malicious\" in vt:\n            score += min(vt[\"malicious\"] * 3, 30)\n        if isinstance(abuse, dict) and \"confidence_score\" in abuse:\n            score += abuse[\"confidence_score\"] * 0.3\n        if isinstance(gn, dict):\n            if gn.get(\"classification\") == \"malicious\":\n                score += 20\n            elif gn.get(\"riot\"):\n                score -= 20  # Known benign service\n        return min(max(score, 0), 100)\n\n    def _calculate_domain_risk(self, result):\n        score = 0\n        vt = result.virustotal\n        if isinstance(vt, dict) and \"malicious\" in vt:\n            score += min(vt[\"malicious\"] * 4, 40)\n            if vt.get(\"reputation\", 0) \u003C -5:\n                score += 20\n        return min(max(score, 0), 100)\n\n    def _calculate_hash_risk(self, result):\n        score = 0\n        vt = result.virustotal\n        if isinstance(vt, dict) and \"malicious\" in vt:\n            total = vt.get(\"total_engines\", 1)\n            detection_rate = vt[\"malicious\"] \u002F total if total > 0 else 0\n            score = detection_rate * 100\n        return min(max(score, 0), 100)\n\n    def _determine_disposition(self, risk_score):\n        if risk_score >= 70:\n            return \"MALICIOUS — Block recommended\"\n        elif risk_score >= 40:\n            return \"SUSPICIOUS — Monitor and investigate\"\n        elif risk_score >= 10:\n            return \"LOW RISK — Likely benign, verify context\"\n        else:\n            return \"CLEAN — No indicators of malicious activity\"\n\n    def close(self):\n        self.vt_client.close()\n```\n\n### Step 2: Batch Enrichment for Incident Investigation\n\n```python\n# Process multiple IOCs from an incident\niocs = [\n    {\"type\": \"ip\", \"value\": \"185.234.218.50\"},\n    {\"type\": \"domain\", \"value\": \"evil-c2-server.com\"},\n    {\"type\": \"hash\", \"value\": \"a1b2c3d4e5f6...\"},\n    {\"type\": \"ip\", \"value\": \"45.33.32.156\"},\n]\n\nconfig = {\n    \"virustotal_key\": \"YOUR_VT_KEY\",\n    \"shodan_key\": \"YOUR_SHODAN_KEY\",\n    \"abuseipdb_key\": \"YOUR_ABUSEIPDB_KEY\",\n    \"greynoise_key\": \"YOUR_GREYNOISE_KEY\",\n    \"urlscan_key\": \"YOUR_URLSCAN_KEY\"\n}\n\nengine = IOCEnrichmentEngine(config)\n\nresults = []\nfor ioc in iocs:\n    if ioc[\"type\"] == \"ip\":\n        result = engine.enrich_ip(ioc[\"value\"])\n    elif ioc[\"type\"] == \"domain\":\n        result = engine.enrich_domain(ioc[\"value\"])\n    elif ioc[\"type\"] == \"hash\":\n        result = engine.enrich_hash(ioc[\"value\"])\n    results.append(result)\n    time.sleep(15)  # Rate limiting for free VT API\n\nengine.close()\n\n# Print summary\nfor r in results:\n    print(f\"{r.ioc_type}: {r.ioc_value}\")\n    print(f\"  Risk Score: {r.risk_score}\")\n    print(f\"  Disposition: {r.disposition}\")\n    print()\n```\n\n### Step 3: Integrate with Splunk for Automated Enrichment\n\nCreate a Splunk custom search command for inline enrichment:\n\n```spl\nindex=notable sourcetype=\"stash\"\n| table src_ip, dest_ip, file_hash, url\n| lookup threat_intel_ip_lookup ip AS src_ip OUTPUT vt_score, abuse_score, disposition\n| lookup threat_intel_hash_lookup hash AS file_hash OUTPUT vt_detections, malware_family\n| eval combined_risk = coalesce(vt_score, 0) + coalesce(abuse_score, 0)\n| where combined_risk > 50\n| sort - combined_risk\n```\n\n### Step 4: Generate Enrichment Report\n\n```python\ndef generate_enrichment_report(results):\n    report = []\n    report.append(\"IOC ENRICHMENT REPORT\")\n    report.append(\"=\" * 60)\n\n    for r in sorted(results, key=lambda x: x.risk_score, reverse=True):\n        report.append(f\"\\n{r.ioc_type.upper()}: {r.ioc_value}\")\n        report.append(f\"  Risk Score: {r.risk_score}\u002F100\")\n        report.append(f\"  Disposition: {r.disposition}\")\n\n        if r.virustotal and \"malicious\" in r.virustotal:\n            report.append(f\"  VirusTotal: {r.virustotal['malicious']}\u002F{r.virustotal.get('total_engines', 'N\u002FA')} malicious\")\n        if r.abuseipdb and \"confidence_score\" in r.abuseipdb:\n            report.append(f\"  AbuseIPDB: {r.abuseipdb['confidence_score']}% confidence, {r.abuseipdb['total_reports']} reports\")\n        if r.greynoise and \"classification\" in r.greynoise:\n            report.append(f\"  GreyNoise: {r.greynoise['classification']}\")\n        if r.shodan_data and \"ports\" in r.shodan_data:\n            report.append(f\"  Shodan: Ports {r.shodan_data['ports']}, Org: {r.shodan_data.get('organization', 'N\u002FA')}\")\n\n    return \"\\n\".join(report)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **IOC Enrichment** | Process of adding contextual intelligence to raw indicators from multiple external sources |\n| **Composite Risk Score** | Weighted aggregate score combining multiple intelligence sources for disposition decisions |\n| **Rate Limiting** | API request restrictions requiring throttling (VT free: 4\u002Fmin, AbuseIPDB: 1000\u002Fday) |\n| **GreyNoise RIOT** | Rule It Out — GreyNoise dataset of known benign services to reduce false positives |\n| **Passive DNS** | Historical DNS resolution data showing domain-to-IP mappings over time |\n| **Defanging** | Modifying IOCs for safe handling in reports (evil.com becomes evil[.]com) |\n\n## Tools & Systems\n\n- **VirusTotal**: Multi-engine malware scanner providing file, URL, IP, and domain analysis with 70+ AV engines\n- **AbuseIPDB**: Community IP reputation database with abuse confidence scoring and ISP attribution\n- **Shodan**: Internet-wide scanner providing open ports, banners, and vulnerability data for IP addresses\n- **GreyNoise**: Internet noise intelligence distinguishing targeted attacks from opportunistic scanning\n- **URLScan.io**: URL analysis platform capturing screenshots, DOM, and network requests for phishing detection\n\n## Common Scenarios\n\n- **Alert Triage Enrichment**: Auto-enrich all IPs in a notable event to determine if source is known malicious\n- **Incident Scope Assessment**: Batch-enrich all IOCs from a compromised host to identify C2 infrastructure\n- **Threat Intel Validation**: Enrich received IOC feed to validate quality before adding to blocking controls\n- **Phishing URL Analysis**: Enrich URLs from reported phishing emails with URLScan and VT before user notification\n- **False Positive Investigation**: Enrich flagged IP to determine if it belongs to CDN\u002Fcloud provider (legitimate)\n\n## Output Format\n\n```\nIOC ENRICHMENT REPORT — IR-2024-0450\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nEnrichment Time: 2024-03-15 14:30 UTC\nIOCs Processed:  4\n\nIP: 185.234.218[.]50\n  Risk Score:   87\u002F100 — MALICIOUS\n  VirusTotal:   14\u002F90 engines flagged malicious\n  AbuseIPDB:    92% confidence, 347 reports\n  Shodan:       Ports [22, 80, 443, 4444], Org: BulletProof Hosting\n  GreyNoise:    malicious — known C2 infrastructure\n  Action:       BLOCK immediately\n\nDOMAIN: evil-c2-server[.]com\n  Risk Score:   73\u002F100 — MALICIOUS\n  VirusTotal:   8\u002F90 engines flagged\n  URLScan:      5 scans, 4 malicious verdicts\n  WHOIS:        Registered 3 days ago via Namecheap\n  Action:       BLOCK and add to DNS sinkhole\n\nHASH: a1b2c3d4e5f6...\n  Risk Score:   91\u002F100 — MALICIOUS\n  VirusTotal:   52\u002F72 engines (Cobalt Strike Beacon)\n  MalwareBazaar: Tags: cobalt-strike, beacon, c2\n  Action:       BLOCK hash, quarantine affected endpoints\n\nIP: 45.33.32[.]156\n  Risk Score:   5\u002F100 — CLEAN\n  VirusTotal:   0\u002F90 engines\n  GreyNoise:    benign — Shodan scanner\n  Action:       No action required (known scanner)\n```\n","# Performing IOC Enrichment Automation\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to quickly enrich IOCs from multiple sources during alert triage\n- High alert volumes require automated enrichment to reduce manual lookup time\n- Incident investigations need comprehensive IOC context for scope assessment\n- SOAR playbooks require enrichment actions as part of automated triage workflows\n\n**Do not use** for bulk blocking decisions without analyst review — enrichment provides context, not definitive malicious\u002Fbenign determination.\n\n## Prerequisites\n\n- API keys: VirusTotal (free or premium), AbuseIPDB, Shodan, URLScan.io, GreyNoise\n- Python 3.8+ with `requests`, `vt-py`, `shodan` libraries\n- MISP instance or TIP for cross-referencing organizational intelligence\n- SOAR platform (optional) for workflow integration\n- Rate limit awareness: VT free (4 req\u002Fmin), AbuseIPDB (1000\u002Fday), Shodan (1 req\u002Fsec)\n\n## Workflow\n\n### Step 1: Build Unified Enrichment Engine\n\nCreate a multi-source enrichment pipeline:\n\n```python\nimport requests\nimport vt\nimport shodan\nimport time\nfrom dataclasses import dataclass, field\nfrom typing import Optional\n\n@dataclass\nclass EnrichmentResult:\n    ioc_value: str\n    ioc_type: str\n    virustotal: dict = field(default_factory=dict)\n    abuseipdb: dict = field(default_factory=dict)\n    shodan_data: dict = field(default_factory=dict)\n    greynoise: dict = field(default_factory=dict)\n    urlscan: dict = field(default_factory=dict)\n    misp_matches: list = field(default_factory=list)\n    risk_score: float = 0.0\n    disposition: str = \"Unknown\"\n\nclass IOCEnrichmentEngine:\n    def __init__(self, config):\n        self.vt_client = vt.Client(config[\"virustotal_key\"])\n        self.shodan_api = shodan.Shodan(config[\"shodan_key\"])\n        self.abuseipdb_key = config[\"abuseipdb_key\"]\n        self.greynoise_key = config[\"greynoise_key\"]\n        self.urlscan_key = config[\"urlscan_key\"]\n\n    def enrich_ip(self, ip_address):\n        result = EnrichmentResult(ioc_value=ip_address, ioc_type=\"ip\")\n\n        # VirusTotal\n        try:\n            vt_obj = self.vt_client.get_object(f\"\u002Fip_addresses\u002F{ip_address}\")\n            result.virustotal = {\n                \"malicious\": vt_obj.last_analysis_stats.get(\"malicious\", 0),\n                \"suspicious\": vt_obj.last_analysis_stats.get(\"suspicious\", 0),\n                \"total_engines\": sum(vt_obj.last_analysis_stats.values()),\n                \"reputation\": vt_obj.reputation,\n                \"country\": getattr(vt_obj, \"country\", \"Unknown\"),\n                \"as_owner\": getattr(vt_obj, \"as_owner\", \"Unknown\")\n            }\n        except Exception as e:\n            result.virustotal = {\"error\": str(e)}\n\n        # AbuseIPDB\n        try:\n            response = requests.get(\n                \"https:\u002F\u002Fapi.abuseipdb.com\u002Fapi\u002Fv2\u002Fcheck\",\n                headers={\"Key\": self.abuseipdb_key, \"Accept\": \"application\u002Fjson\"},\n                params={\"ipAddress\": ip_address, \"maxAgeInDays\": 90}\n            )\n            data = response.json()[\"data\"]\n            result.abuseipdb = {\n                \"confidence_score\": data[\"abuseConfidenceScore\"],\n                \"total_reports\": data[\"totalReports\"],\n                \"is_tor\": data.get(\"isTor\", False),\n                \"usage_type\": data.get(\"usageType\", \"Unknown\"),\n                \"isp\": data.get(\"isp\", \"Unknown\"),\n                \"domain\": data.get(\"domain\", \"Unknown\")\n            }\n        except Exception as e:\n            result.abuseipdb = {\"error\": str(e)}\n\n        # Shodan\n        try:\n            host = self.shodan_api.host(ip_address)\n            result.shodan_data = {\n                \"ports\": host.get(\"ports\", []),\n                \"os\": host.get(\"os\", \"Unknown\"),\n                \"organization\": host.get(\"org\", \"Unknown\"),\n                \"isp\": host.get(\"isp\", \"Unknown\"),\n                \"vulns\": host.get(\"vulns\", []),\n                \"last_update\": host.get(\"last_update\", \"Unknown\")\n            }\n        except shodan.APIError:\n            result.shodan_data = {\"status\": \"Not found in Shodan\"}\n\n        # GreyNoise\n        try:\n            response = requests.get(\n                f\"https:\u002F\u002Fapi.greynoise.io\u002Fv3\u002Fcommunity\u002F{ip_address}\",\n                headers={\"key\": self.greynoise_key}\n            )\n            gn_data = response.json()\n            result.greynoise = {\n                \"classification\": gn_data.get(\"classification\", \"unknown\"),\n                \"noise\": gn_data.get(\"noise\", False),\n                \"riot\": gn_data.get(\"riot\", False),\n                \"name\": gn_data.get(\"name\", \"Unknown\")\n            }\n        except Exception as e:\n            result.greynoise = {\"error\": str(e)}\n\n        # Calculate composite risk score\n        result.risk_score = self._calculate_ip_risk(result)\n        result.disposition = self._determine_disposition(result.risk_score)\n        return result\n\n    def enrich_domain(self, domain):\n        result = EnrichmentResult(ioc_value=domain, ioc_type=\"domain\")\n\n        # VirusTotal\n        try:\n            vt_obj = self.vt_client.get_object(f\"\u002Fdomains\u002F{domain}\")\n            result.virustotal = {\n                \"malicious\": vt_obj.last_analysis_stats.get(\"malicious\", 0),\n                \"suspicious\": vt_obj.last_analysis_stats.get(\"suspicious\", 0),\n                \"reputation\": vt_obj.reputation,\n                \"creation_date\": getattr(vt_obj, \"creation_date\", \"Unknown\"),\n                \"registrar\": getattr(vt_obj, \"registrar\", \"Unknown\"),\n                \"categories\": getattr(vt_obj, \"categories\", {})\n            }\n        except Exception as e:\n            result.virustotal = {\"error\": str(e)}\n\n        # URLScan.io\n        try:\n            response = requests.get(\n                f\"https:\u002F\u002Furlscan.io\u002Fapi\u002Fv1\u002Fsearch\u002F?q=domain:{domain}\",\n                headers={\"API-Key\": self.urlscan_key}\n            )\n            scans = response.json().get(\"results\", [])\n            result.urlscan = {\n                \"total_scans\": len(scans),\n                \"verdicts\": [s.get(\"verdicts\", {}).get(\"overall\", {}).get(\"malicious\", False)\n                            for s in scans[:5]],\n                \"last_scan\": scans[0][\"task\"][\"time\"] if scans else \"Never scanned\"\n            }\n        except Exception as e:\n            result.urlscan = {\"error\": str(e)}\n\n        result.risk_score = self._calculate_domain_risk(result)\n        result.disposition = self._determine_disposition(result.risk_score)\n        return result\n\n    def enrich_hash(self, file_hash):\n        result = EnrichmentResult(ioc_value=file_hash, ioc_type=\"hash\")\n\n        # VirusTotal\n        try:\n            vt_obj = self.vt_client.get_object(f\"\u002Ffiles\u002F{file_hash}\")\n            result.virustotal = {\n                \"malicious\": vt_obj.last_analysis_stats.get(\"malicious\", 0),\n                \"suspicious\": vt_obj.last_analysis_stats.get(\"suspicious\", 0),\n                \"undetected\": vt_obj.last_analysis_stats.get(\"undetected\", 0),\n                \"total_engines\": sum(vt_obj.last_analysis_stats.values()),\n                \"type_description\": getattr(vt_obj, \"type_description\", \"Unknown\"),\n                \"popular_threat_name\": getattr(vt_obj, \"popular_threat_classification\", {}).get(\n                    \"suggested_threat_label\", \"Unknown\"\n                ),\n                \"sandbox_verdicts\": getattr(vt_obj, \"sandbox_verdicts\", {}),\n                \"first_seen\": getattr(vt_obj, \"first_submission_date\", \"Unknown\")\n            }\n        except vt.APIError:\n            result.virustotal = {\"status\": \"Not found in VirusTotal\"}\n\n        # MalwareBazaar\n        try:\n            response = requests.post(\n                \"https:\u002F\u002Fmb-api.abuse.ch\u002Fapi\u002Fv1\u002F\",\n                data={\"query\": \"get_info\", \"hash\": file_hash}\n            )\n            mb_data = response.json()\n            if mb_data[\"query_status\"] == \"ok\":\n                entry = mb_data[\"data\"][0]\n                result.abuseipdb = {  # Reusing field for MalwareBazaar data\n                    \"malware_family\": entry.get(\"signature\", \"Unknown\"),\n                    \"tags\": entry.get(\"tags\", []),\n                    \"file_type\": entry.get(\"file_type\", \"Unknown\"),\n                    \"delivery_method\": entry.get(\"delivery_method\", \"Unknown\"),\n                    \"first_seen\": entry.get(\"first_seen\", \"Unknown\")\n                }\n        except Exception:\n            pass\n\n        result.risk_score = self._calculate_hash_risk(result)\n        result.disposition = self._determine_disposition(result.risk_score)\n        return result\n\n    def _calculate_ip_risk(self, result):\n        score = 0\n        vt = result.virustotal\n        abuse = result.abuseipdb\n        gn = result.greynoise\n\n        if isinstance(vt, dict) and \"malicious\" in vt:\n            score += min(vt[\"malicious\"] * 3, 30)\n        if isinstance(abuse, dict) and \"confidence_score\" in abuse:\n            score += abuse[\"confidence_score\"] * 0.3\n        if isinstance(gn, dict):\n            if gn.get(\"classification\") == \"malicious\":\n                score += 20\n            elif gn.get(\"riot\"):\n                score -= 20  # Known benign service\n        return min(max(score, 0), 100)\n\n    def _calculate_domain_risk(self, result):\n        score = 0\n        vt = result.virustotal\n        if isinstance(vt, dict) and \"malicious\" in vt:\n            score += min(vt[\"malicious\"] * 4, 40)\n            if vt.get(\"reputation\", 0) \u003C -5:\n                score += 20\n        return min(max(score, 0), 100)\n\n    def _calculate_hash_risk(self, result):\n        score = 0\n        vt = result.virustotal\n        if isinstance(vt, dict) and \"malicious\" in vt:\n            total = vt.get(\"total_engines\", 1)\n            detection_rate = vt[\"malicious\"] \u002F total if total > 0 else 0\n            score = detection_rate * 100\n        return min(max(score, 0), 100)\n\n    def _determine_disposition(self, risk_score):\n        if risk_score >= 70:\n            return \"MALICIOUS — Block recommended\"\n        elif risk_score >= 40:\n            return \"SUSPICIOUS — Monitor and investigate\"\n        elif risk_score >= 10:\n            return \"LOW RISK — Likely benign, verify context\"\n        else:\n            return \"CLEAN — No indicators of malicious activity\"\n\n    def close(self):\n        self.vt_client.close()\n```\n\n### Step 2: Batch Enrichment for Incident Investigation\n\n```python\n# Process multiple IOCs from an incident\niocs = [\n    {\"type\": \"ip\", \"value\": \"185.234.218.50\"},\n    {\"type\": \"domain\", \"value\": \"evil-c2-server.com\"},\n    {\"type\": \"hash\", \"value\": \"a1b2c3d4e5f6...\"},\n    {\"type\": \"ip\", \"value\": \"45.33.32.156\"},\n]\n\nconfig = {\n    \"virustotal_key\": \"YOUR_VT_KEY\",\n    \"shodan_key\": \"YOUR_SHODAN_KEY\",\n    \"abuseipdb_key\": \"YOUR_ABUSEIPDB_KEY\",\n    \"greynoise_key\": \"YOUR_GREYNOISE_KEY\",\n    \"urlscan_key\": \"YOUR_URLSCAN_KEY\"\n}\n\nengine = IOCEnrichmentEngine(config)\n\nresults = []\nfor ioc in iocs:\n    if ioc[\"type\"] == \"ip\":\n        result = engine.enrich_ip(ioc[\"value\"])\n    elif ioc[\"type\"] == \"domain\":\n        result = engine.enrich_domain(ioc[\"value\"])\n    elif ioc[\"type\"] == \"hash\":\n        result = engine.enrich_hash(ioc[\"value\"])\n    results.append(result)\n    time.sleep(15)  # Rate limiting for free VT API\n\nengine.close()\n\n# Print summary\nfor r in results:\n    print(f\"{r.ioc_type}: {r.ioc_value}\")\n    print(f\"  Risk Score: {r.risk_score}\")\n    print(f\"  Disposition: {r.disposition}\")\n    print()\n```\n\n### Step 3: Integrate with Splunk for Automated Enrichment\n\nCreate a Splunk custom search command for inline enrichment:\n\n```spl\nindex=notable sourcetype=\"stash\"\n| table src_ip, dest_ip, file_hash, url\n| lookup threat_intel_ip_lookup ip AS src_ip OUTPUT vt_score, abuse_score, disposition\n| lookup threat_intel_hash_lookup hash AS file_hash OUTPUT vt_detections, malware_family\n| eval combined_risk = coalesce(vt_score, 0) + coalesce(abuse_score, 0)\n| where combined_risk > 50\n| sort - combined_risk\n```\n\n### Step 4: Generate Enrichment Report\n\n```python\ndef generate_enrichment_report(results):\n    report = []\n    report.append(\"IOC ENRICHMENT REPORT\")\n    report.append(\"=\" * 60)\n\n    for r in sorted(results, key=lambda x: x.risk_score, reverse=True):\n        report.append(f\"\\n{r.ioc_type.upper()}: {r.ioc_value}\")\n        report.append(f\"  Risk Score: {r.risk_score}\u002F100\")\n        report.append(f\"  Disposition: {r.disposition}\")\n\n        if r.virustotal and \"malicious\" in r.virustotal:\n            report.append(f\"  VirusTotal: {r.virustotal['malicious']}\u002F{r.virustotal.get('total_engines', 'N\u002FA')} malicious\")\n        if r.abuseipdb and \"confidence_score\" in r.abuseipdb:\n            report.append(f\"  AbuseIPDB: {r.abuseipdb['confidence_score']}% confidence, {r.abuseipdb['total_reports']} reports\")\n        if r.greynoise and \"classification\" in r.greynoise:\n            report.append(f\"  GreyNoise: {r.greynoise['classification']}\")\n        if r.shodan_data and \"ports\" in r.shodan_data:\n            report.append(f\"  Shodan: Ports {r.shodan_data['ports']}, Org: {r.shodan_data.get('organization', 'N\u002FA')}\")\n\n    return \"\\n\".join(report)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **IOC Enrichment** | Process of adding contextual intelligence to raw indicators from multiple external sources |\n| **Composite Risk Score** | Weighted aggregate score combining multiple intelligence sources for disposition decisions |\n| **Rate Limiting** | API request restrictions requiring throttling (VT free: 4\u002Fmin, AbuseIPDB: 1000\u002Fday) |\n| **GreyNoise RIOT** | Rule It Out — GreyNoise dataset of known benign services to reduce false positives |\n| **Passive DNS** | Historical DNS resolution data showing domain-to-IP mappings over time |\n| **Defanging** | Modifying IOCs for safe handling in reports (evil.com becomes evil[.]com) |\n\n## Tools & Systems\n\n- **VirusTotal**: Multi-engine malware scanner providing file, URL, IP, and domain analysis with 70+ AV engines\n- **AbuseIPDB**: Community IP reputation database with abuse confidence scoring and ISP attribution\n- **Shodan**: Internet-wide scanner providing open ports, banners, and vulnerability data for IP addresses\n- **GreyNoise**: Internet noise intelligence distinguishing targeted attacks from opportunistic scanning\n- **URLScan.io**: URL analysis platform capturing screenshots, DOM, and network requests for phishing detection\n\n## Common Scenarios\n\n- **Alert Triage Enrichment**: Auto-enrich all IPs in a notable event to determine if source is known malicious\n- **Incident Scope Assessment**: Batch-enrich all IOCs from a compromised host to identify C2 infrastructure\n- **Threat Intel Validation**: Enrich received IOC feed to validate quality before adding to blocking controls\n- **Phishing URL Analysis**: Enrich URLs from reported phishing emails with URLScan and VT before user notification\n- **False Positive Investigation**: Enrich flagged IP to determine if it belongs to CDN\u002Fcloud provider (legitimate)\n\n## Output Format\n\n```\nIOC ENRICHMENT REPORT — IR-2024-0450\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nEnrichment Time: 2024-03-15 14:30 UTC\nIOCs Processed:  4\n\nIP: 185.234.218[.]50\n  Risk Score:   87\u002F100 — MALICIOUS\n  VirusTotal:   14\u002F90 engines flagged malicious\n  AbuseIPDB:    92% confidence, 347 reports\n  Shodan:       Ports [22, 80, 443, 4444], Org: BulletProof Hosting\n  GreyNoise:    malicious — known C2 infrastructure\n  Action:       BLOCK immediately\n\nDOMAIN: evil-c2-server[.]com\n  Risk Score:   73\u002F100 — MALICIOUS\n  VirusTotal:   8\u002F90 engines flagged\n  URLScan:      5 scans, 4 malicious verdicts\n  WHOIS:        Registered 3 days ago via Namecheap\n  Action:       BLOCK and add to DNS sinkhole\n\nHASH: a1b2c3d4e5f6...\n  Risk Score:   91\u002F100 — MALICIOUS\n  VirusTotal:   52\u002F72 engines (Cobalt Strike Beacon)\n  MalwareBazaar: Tags: cobalt-strike, beacon, c2\n  Action:       BLOCK hash, quarantine affected endpoints\n\nIP: 45.33.32[.]156\n  Risk Score:   5\u002F100 — CLEAN\n  VirusTotal:   0\u002F90 engines\n  GreyNoise:    benign — Shodan scanner\n  Action:       No action required (known scanner)\n```\n",{"name":5,"tags":48,"author":52,"domain":36,"license":15,"version":53,"nist_csf":54,"subdomain":59,"description":60,"mitre_attack":61},[38,26,27,25,49,50,51,39],"virustotal","abuseipdb","shodan","mahipal","1.0",[55,56,57,58],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.\n",[62,63,64,65],"T1078","T1685.002","T1685.005","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-ioc-enrichment-automation",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ioc-enrichment-automation",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ioc-enrichment-automation",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ioc-enrichment-automation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ioc-enrichment-automation\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ioc-enrichment-automation\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",1767,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ioc-enrichment-automation\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",9251,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ioc-enrichment-automation\u002Fscripts\u002Fagent.py",[108,135,159,186,212,239],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,120,36,121,122,123,124,125,126,127,128,129,130,131,132,133,134],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,131,144,145,120,146,36,123,147,148,149,150,151,152,153,154,155,156,157,158],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":169,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[165,168],{"categoryNo":166,"categoryName":167,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,170,171,172,173,36,174,175,147,176,177,178,179,180,181,31,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,36,197,198,199,200,201,202,203,204,205,206,207,208,150,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,36,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[120,247,36,248,40,26,38,249,250,251,252,31,253,182,254,255,256,257,258,259],"triaging security incident","siem","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]