Misp

building-ioc-defanging-and-sharing-pipeline skill for extracting IOCs, defanging URLs, IPs, domains, emails, and hashes, then converting and sharing them as STIX 2.1 via TAXII or MISP for security audit and threat intel workflows.

The generating-threat-intelligence-reports skill turns analyzed cyber data into strategic, operational, tactical, or flash threat intelligence reports for executives, SOC teams, IR leads, and analysts. It supports finished intelligence, confidence language, TLP handling, and clear recommendations for Report Writing.

extracting-iocs-from-malware-samples skill guide for malware analysis: extract hashes, IPs, domains, URLs, host artifacts, and validation cues from samples for threat intel and detection.

evaluating-threat-intelligence-platforms helps you compare TIP products by feed ingestion, STIX/TAXII support, automation, analyst workflow, integrations, and total cost of ownership. Use this evaluating-threat-intelligence-platforms guide for procurement, migration, or maturity planning, including evaluating-threat-intelligence-platforms for Threat Modeling when platform choice affects traceability and evidence sharing.

correlating-threat-campaigns helps Threat Intelligence analysts correlate incidents, IOCs, and TTPs into campaign-level evidence. Use it to compare historical events, separate strong links from weak matches, and build defensible clustering for MISP, SIEM, and CTI reporting.

The collecting-threat-intelligence-with-misp skill helps you collect, normalize, search, and export threat intelligence in MISP. Use this collecting-threat-intelligence-with-misp guide for feeds, PyMISP workflows, event filtering, warninglist reduction, and practical collecting-threat-intelligence-with-misp for Threat Modeling and CTI operations.

collecting-indicators-of-compromise skill for extracting, enriching, scoring, and exporting IOCs from incident evidence. Use it for Security Audit workflows, threat intel sharing, and STIX 2.1 output when you need a practical collecting-indicators-of-compromise guide instead of a generic incident-response prompt.

building-threat-intelligence-platform skill for designing, deploying, and reviewing a threat intelligence platform with MISP, OpenCTI, TheHive, Cortex, STIX/TAXII, and Elasticsearch. Use it for installation guidance, usage workflows, and Security Audit planning backed by repository references and scripts.

building-threat-feed-aggregation-with-misp helps you deploy MISP to aggregate, correlate, and share threat intelligence feeds for centralized IOC management and SIEM integration. This skill guide covers install and usage patterns, feed synchronization, API actions, and practical workflow steps for Threat Intelligence teams.

automating-ioc-enrichment helps automate IOC enrichment with VirusTotal, AbuseIPDB, Shodan, and STIX 2.1 for SOAR playbooks, Python pipelines, and Workflow Automation. Use this automating-ioc-enrichment skill to standardize analyst-ready context, reduce triage time, and shape repeatable enrichment outputs.

Analyze the threat landscape using MISP with the analyzing-threat-landscape-with-misp skill. It summarizes event statistics, IoC distributions, threat actor and malware trends, and time-based changes to support Threat Intelligence reports, SOC briefings, and hunting priorities.

Analyzing-threat-intelligence-feeds helps you ingest CTI feeds, normalize indicators, assess feed quality, and enrich IOCs for STIX 2.1 workflows. This analyzing-threat-intelligence-feeds skill is built for threat intel operations and Data Analysis, with practical guidance for TAXII, MISP, and commercial feeds.

Analyzing-indicators-of-compromise helps triage IOCs such as IPs, domains, URLs, file hashes, and email artifacts. It supports threat-intelligence workflows for enrichment, confidence scoring, and block/monitor/whitelist decisions using source-backed checks and clear analyst context.