Ioc

building-ioc-defanging-and-sharing-pipeline skill for extracting IOCs, defanging URLs, IPs, domains, emails, and hashes, then converting and sharing them as STIX 2.1 via TAXII or MISP for security audit and threat intel workflows.

analyzing-supply-chain-malware-artifacts is a malware-analysis skill for tracing trojanized updates, poisoned dependencies, and build-pipeline tampering. Use it to compare trusted and untrusted artifacts, extract indicators, assess compromise scope, and report findings with less guesswork.

extracting-iocs-from-malware-samples skill guide for malware analysis: extract hashes, IPs, domains, URLs, host artifacts, and validation cues from samples for threat intel and detection.

The collecting-threat-intelligence-with-misp skill helps you collect, normalize, search, and export threat intelligence in MISP. Use this collecting-threat-intelligence-with-misp guide for feeds, PyMISP workflows, event filtering, warninglist reduction, and practical collecting-threat-intelligence-with-misp for Threat Modeling and CTI operations.

collecting-indicators-of-compromise skill for extracting, enriching, scoring, and exporting IOCs from incident evidence. Use it for Security Audit workflows, threat intel sharing, and STIX 2.1 output when you need a practical collecting-indicators-of-compromise guide instead of a generic incident-response prompt.

building-threat-intelligence-platform skill for designing, deploying, and reviewing a threat intelligence platform with MISP, OpenCTI, TheHive, Cortex, STIX/TAXII, and Elasticsearch. Use it for installation guidance, usage workflows, and Security Audit planning backed by repository references and scripts.

automating-ioc-enrichment helps automate IOC enrichment with VirusTotal, AbuseIPDB, Shodan, and STIX 2.1 for SOAR playbooks, Python pipelines, and Workflow Automation. Use this automating-ioc-enrichment skill to standardize analyst-ready context, reduce triage time, and shape repeatable enrichment outputs.

Analyze the threat landscape using MISP with the analyzing-threat-landscape-with-misp skill. It summarizes event statistics, IoC distributions, threat actor and malware trends, and time-based changes to support Threat Intelligence reports, SOC briefings, and hunting priorities.

Analyzing-threat-intelligence-feeds helps you ingest CTI feeds, normalize indicators, assess feed quality, and enrich IOCs for STIX 2.1 workflows. This analyzing-threat-intelligence-feeds skill is built for threat intel operations and Data Analysis, with practical guidance for TAXII, MISP, and commercial feeds.

The analyzing-threat-actor-ttps-with-mitre-attack skill helps map threat reports to MITRE ATT&CK tactics, techniques, and sub-techniques, build coverage views, and prioritize detection gaps. It includes a reporting template, ATT&CK references, and scripts for technique lookup and gap analysis, making it useful for CTI, SOC, detection engineering, and threat modeling.

Analyzing-indicators-of-compromise helps triage IOCs such as IPs, domains, URLs, file hashes, and email artifacts. It supports threat-intelligence workflows for enrichment, confidence scoring, and block/monitor/whitelist decisions using source-backed checks and clear analyst context.