Which threat intelligence feeds are compatible?

It supports standard MISP feeds, Freetext feeds, TAXII 2.1 feeds, and custom CSV mappings from providers such as abuse.ch and CIRCL.

Does this skill support the PyMISP API?

Yes, it includes specific workflows for using the PyMISP Python library to authenticate, search events, and add attributes to your MISP instance.

What are the prerequisites for using this MISP skill?

You will need Python 3.9+, Docker for deployment, and an understanding of IOC types like IP addresses, hashes, and domains.

What is MISP and how does this skill help?

MISP (Malware Information Sharing Platform) is an open-source tool for managing threat intelligence. This skill provides the automation logic and best practices to deploy MISP and manage Indicators of Compromise (IOCs) programmatically.

Can I export data to my SIEM or firewall?

Absolutely. The skill covers exporting threat data into various formats including STIX 2.1 bundles, CSV for SIEM ingestion, and Suricata rules for IDS/IPS systems.

MISP Threat Intelligence Collector

Name: MISP Threat Intelligence Collector
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Automates the collection, sharing, and correlation of Indicators of Compromise (IOCs) using the MISP platform and PyMISP API.

This skill provides a structured framework for managing threat intelligence within the Malware Information Sharing Platform (MISP). It guides users through deploying MISP via Docker, configuring automated threat feeds from community sources like CIRCL and botvrij.eu, and utilizing the PyMISP library for programmatic IOC management. Designed for security operations and threat hunting teams, it enables the automation of complex workflows including event searching, data correlation, and multi-format exports for downstream security tools like SIEMs or IDS/IPS systems using STIX 2.1 and Suricata rules.

主要功能

01Programmatic IOC management and event searching via PyMISP API

02Correlation of threat actor clusters and malware with MITRE ATT&CK galaxies

034,121 GitHub stars

04Automated MISP instance deployment using Docker Compose

05Configuration of community-led and commercial threat intelligence feeds

06Data export workflows for STIX 2.1, TAXII, CSV, and Suricata formats

使用场景

01Building an automated threat intelligence pipeline for SOC operations

02Integrating curated threat data into SIEM or IDS tools for real-time detection

03Synchronizing and aggregating IOCs from multiple global community feeds

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills collecting-threat-intelligence-with-misp

For use in Claude.ai and ChatGPT

主要功能

01Programmatic IOC management and event searching via PyMISP API

02Correlation of threat actor clusters and malware with MITRE ATT&CK galaxies

034,121 GitHub stars

04Automated MISP instance deployment using Docker Compose

05Configuration of community-led and commercial threat intelligence feeds

06Data export workflows for STIX 2.1, TAXII, CSV, and Suricata formats

使用场景

01Building an automated threat intelligence pipeline for SOC operations

02Integrating curated threat data into SIEM or IDS tools for real-time detection

03Synchronizing and aggregating IOCs from multiple global community feeds

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills collecting-threat-intelligence-with-misp

For use in Claude.ai and ChatGPT