Can I use this to pull data from MITRE ATT&CK?

Yes, the skill includes specific workflows and endpoints for connecting to the official MITRE ATT&CK TAXII server and extracting Enterprise ATT&CK collections.

Can I implement a TAXII producer as well as a consumer?

Yes, the skill covers both consuming intelligence from external feeds and pushing STIX bundles to a TAXII server, including setup for a local server using Medallion.

What versions of STIX and TAXII does this skill support?

This skill specifically focuses on the STIX 2.1 and TAXII 2.1 standards, which are the modern REST-based protocols for cyber threat intelligence exchange.

What Python libraries are required to use this skill?

Implementation requires Python 3.9+ with the taxii2-client, stix2, and cti-taxii-client libraries installed.

How does this skill handle large threat intelligence datasets?

It implements paginated polling and memory-efficient parsing to handle large collections without crashing, ensuring reliable ingestion of high-volume feeds.

STIX/TAXII Threat Intelligence Integration

Name: STIX/TAXII Threat Intelligence Integration
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Implements standardized cyber threat intelligence feeds using STIX and TAXII protocols to automate the exchange of security data.

This skill enables developers and security engineers to build robust integrations for Structured Threat Information eXpression (STIX) and Trusted Automated eXchange of Intelligence Information (TAXII) 2.1. It provides comprehensive implementation patterns for server discovery, paginated polling of intelligence collections, and parsing complex STIX 2.1 object models including Indicators of Compromise (IOCs) and Cyber Observables. By leveraging industry-standard Python libraries, this skill facilitates the seamless ingestion of threat feeds from sources like MITRE ATT&CK into SIEM platforms, Threat Intelligence Platforms (TIPs), or custom security automation tools.

主要功能

01Incremental polling state tracking for real-time intelligence updates

02Local TAXII server configuration and management using Medallion

03Efficient IOC extraction and filtering from threat bundles

04Automated TAXII 2.1 server discovery and collection management

05Paginated fetching and parsing of STIX 2.1 SDOs, SCOs, and SROs

064,121 GitHub stars

使用场景

01Setting up an internal TAXII server to share proprietary intelligence across different security teams.

02Building a custom threat intelligence consumer to automate the extraction of actionable indicators.

03Ingesting MITRE ATT&CK data into a custom Security Information and Event Management (SIEM) system.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills implementing-stix-taxii-feed-integration

For use in Claude.ai and ChatGPT

主要功能

01Incremental polling state tracking for real-time intelligence updates

02Local TAXII server configuration and management using Medallion

03Efficient IOC extraction and filtering from threat bundles

04Automated TAXII 2.1 server discovery and collection management

05Paginated fetching and parsing of STIX 2.1 SDOs, SCOs, and SROs

064,121 GitHub stars

使用场景

01Setting up an internal TAXII server to share proprietary intelligence across different security teams.

02Building a custom threat intelligence consumer to automate the extraction of actionable indicators.

03Ingesting MITRE ATT&CK data into a custom Security Information and Event Management (SIEM) system.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills implementing-stix-taxii-feed-integration

For use in Claude.ai and ChatGPT