Indicator Lifecycle Management

This skill enables Claude to implement and automate structured processes for Cyber Threat Intelligence (CTI). It provides specialized logic for tracking IOC quality, applying time-based confidence decay, monitoring detection efficacy, and managing false positives. By integrating with platforms like MISP and OpenCTI, it helps security teams maintain a high-fidelity, actionable indicator database while minimizing alert fatigue through systematic aging and expiration policies based on specific IOC types like IPs, domains, and file hashes.

主要功能

使用场景