Does this skill perform automated blocking of malicious IPs?

No, it focuses on enrichment and triage context. It is designed to inform human decisions rather than execute high-impact blocking actions autonomously.

Which platforms does this IOC enrichment skill support?

It supports major SOAR platforms including Cortex XSOAR, Splunk SOAR, Tines, and n8n, as well as custom Python 3.9+ environments.

Can I use this for bulk processing of threat feeds?

Yes, it is optimized for both real-time SIEM alert enrichment and high-volume bulk processing from threat feeds or phishing submission pipelines.

Which threat intelligence sources can be integrated?

The skill provides patterns for VirusTotal, AbuseIPDB, Shodan, MISP, OpenCTI, and URLScan.io.

How does it handle API rate limits for free-tier tools?

It includes specific implementation patterns for rate-limiting decorators and retry-on-429 logic to ensure pipelines respect provider quotas.

Automated IOC Enrichment & Threat Intel

Name: Automated IOC Enrichment & Threat Intel
Author: micsapp

bymicsapp

0•

Security & Testing

Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context to streamline security operations and reduce triage time.

This skill provides a standardized framework for security analysts and engineers to automate the enrichment of Indicators of Compromise (IOCs) such as IPs, domains, and file hashes. By integrating data from platforms like VirusTotal, Shodan, and MISP into SOAR playbooks or custom Python pipelines, it enables teams to calculate composite confidence scores and pre-populate alert contexts. It is particularly useful for reducing Mean Time to Triage (MTTT) in SOC environments and ensuring that analysts have immediate access to high-fidelity threat intelligence without manual lookups.

Key Features

01Pre-built SOAR playbook logic for Cortex XSOAR and Splunk SOAR

02Multi-source enrichment for IPs, domains, URLs, and file hashes

030 GitHub stars

04Composite confidence score calculation using weighted vendor signals

05Standardized pipeline architectures for SIEM and phishing ingestion

06Automated rate-limiting and retry logic for third-party API management

Use Cases

01Pre-populating SIEM alerts with contextual threat data before analyst review

02Building automated Python pipelines for high-volume phishing email analysis

03Cross-referencing internal threat data with public feeds for bulk IOC processing

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills automating-ioc-enrichment

For use in Claude.ai and ChatGPT

Key Features

01Pre-built SOAR playbook logic for Cortex XSOAR and Splunk SOAR

02Multi-source enrichment for IPs, domains, URLs, and file hashes

030 GitHub stars

04Composite confidence score calculation using weighted vendor signals

05Standardized pipeline architectures for SIEM and phishing ingestion

06Automated rate-limiting and retry logic for third-party API management

Use Cases

01Pre-populating SIEM alerts with contextual threat data before analyst review

02Building automated Python pipelines for high-volume phishing email analysis

03Cross-referencing internal threat data with public feeds for bulk IOC processing

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills automating-ioc-enrichment

For use in Claude.ai and ChatGPT