Does this skill provide automation for Splunk?

Yes, it includes Python workflows for exporting MISP indicators to Splunk via the HTTP Event Collector (HEC) for real-time threat matching.

What is MISP used for in this skill?

MISP is used as a central platform to aggregate, store, and correlate threat intelligence indicators (IOCs) from multiple OSINT and commercial sources.

Can I deploy MISP locally using this guide?

Yes, the skill provides a complete Docker Compose configuration to deploy MISP, its database, and Redis cache in a containerized environment.

PyMISP is a Python library used in this skill to interact with the MISP API, allowing you to automate feed management and indicator searches.

MISP Threat Feed Aggregation & Automation

Name: MISP Threat Feed Aggregation & Automation
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Deploy and manage MISP for automated threat intelligence collection, correlation, and SIEM integration.

This skill enables security teams to implement a centralized Threat Intelligence Platform (TIP) using MISP. It covers the end-to-end lifecycle of threat intelligence, including containerized deployment via Docker, automated ingestion from global OSINT feeds like abuse.ch and AlienVault OTX, and indicator correlation across events. Designed for security engineers, it provides practical patterns for using PyMISP for automation and creating seamless integration pipelines with security operations tools like Splunk and Elasticsearch to enhance threat detection and response capabilities.

主要功能

01Containerized MISP deployment using Docker and Docker Compose

02Automated IOC export to SIEM platforms like Splunk and Elasticsearch

03Cross-event indicator correlation and context mapping

044,121 GitHub stars

05Custom blocklist generation for firewalls and proxy systems

06Automated feed configuration and synchronization via PyMISP API

使用场景

01Enriching SIEM alerts with contextual threat intelligence and attribution

02Centralizing disparate threat intelligence feeds into a single correlated platform

03Automating the blocklist generation process for network security appliances

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills building-threat-feed-aggregation-with-misp

For use in Claude.ai and ChatGPT

主要功能

01Containerized MISP deployment using Docker and Docker Compose

02Automated IOC export to SIEM platforms like Splunk and Elasticsearch

03Cross-event indicator correlation and context mapping

044,121 GitHub stars

05Custom blocklist generation for firewalls and proxy systems

06Automated feed configuration and synchronization via PyMISP API

使用场景

01Enriching SIEM alerts with contextual threat intelligence and attribution

02Centralizing disparate threat intelligence feeds into a single correlated platform

03Automating the blocklist generation process for network security appliances

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills building-threat-feed-aggregation-with-misp

For use in Claude.ai and ChatGPT