Mmcp.market

analyzing-threat-intelligence-feeds skill

by mukul975·mukul975/Anthropic-Cybersecurity-Skills·34k stars·Apache-2.0

'Analyzes structured and unstructured threat intelligence feeds to extract

A100/100content scan

Is the analyzing-threat-intelligence-feeds skill safe?

Clean: nothing in its files matched our rules. We read 4 files in the folder on 2026-09-28.

No findings.

Install the analyzing-threat-intelligence-feeds skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. 

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git /tmp/Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills
cp -r /tmp/Anthropic-Cybersecurity-Skills/skills/analyzing-threat-intelligence-feeds ~/.claude/skills/analyzing-threat-intelligence-feeds
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

Analyzing Threat Intelligence Feeds

When to Use

Use this skill when:

  • Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio
  • Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema
  • Evaluating feed freshness, fidelity, and relevance to the organization's threat profile
  • Building automated enrichment pipelines that correlate IOCs against SIEM events

Do not use this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline.

Prerequisites

  • Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI
  • API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise)
  • TAXII 2.1 client library (taxii2-client Python package or equivalent)
  • Role with read/write permissions to the TIP's indicator database

Workflow

Step 1: Enumerate and Prioritize Feed Sources

List all available feeds categorized by type (commercial, government, ISAC, OSINT):

  • Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence
  • Government: CISA AIS (Automated Indicator Sharing), FBI InfraGard, MS-ISAC
  • OSINT: AlienVault OTX, Abuse.ch, PhishTank, Emerging Threats

Score each feed on: update frequency, historical accuracy rate, coverage of your sector, and attribution depth. Use a weighted scoring matrix with criteria from NIST SP 800-150 (Guide to Cyber Threat Information Sharing).

Step 2: Ingest via TAXII 2.1 or API

For TAXII-enabled feeds:

taxii2-client discover https://feed.example.com/taxii/
taxii2-client get-collection --collection-id <id> --since 2024-01-01

For REST API feeds (e.g., Recorded Future):

  • Query /v2/indicator/search with riskscoremin=65 to filter low-confidence IOCs
  • Apply rate limiting and exponential backoff for API resilience

Step 3: Normalize to STIX 2.1

Convert each IOC to STIX 2.1 objects using the OASIS standard schema:

  • IP address → indicator object with pattern: "[ipv4-addr:value = '...']"
  • Domain → indicator with pattern: "[domain-name:value = '...']"
  • File hash → indicator with pattern: "[file:hashes.SHA-256 = '...']"

Attach relationship objects linking indicators to threat-actor or malware objects. Use confidence field (0–100) based on source fidelity rating.

Step 4: Deduplicate and Enrich

Run deduplication against existing TIP database using normalized value + type as composite key. Enrich surviving IOCs:

  • VirusTotal: detection ratio, sandbox behavior reports
  • PassiveTotal (RiskIQ): WHOIS history, passive DNS, SSL certificate chains
  • Shodan: banner data, open ports, geographic location

Step 5: Distribute to Consuming Systems

Export enriched indicators via TAXII 2.1 push to SIEM (Splunk, Microsoft Sentinel), firewalls (Palo Alto XSOAR playbooks), and EDR platforms. Set TTL (time-to-live) per indicator type: IP addresses 30 days, domains 90 days, file hashes 1 year.

Key Concepts

Tools & Systems

  • ThreatConnect TC Exchange: Aggregates 100+ commercial and OSINT feeds; provides automated playbooks for IOC enrichment
  • MISP (Malware Information Sharing Platform): Open-source TIP supporting STIX/TAXII; widely used by ISACs and government CERTs
  • OpenCTI: Open-source platform with native MITRE ATT&CK integration and graph-based relationship visualization
  • Recorded Future: Commercial feed with AI-powered risk scoring and real-time dark web monitoring
  • taxii2-client: Python library for TAXII 2.0/2.1 client operations (pip install taxii2-client)
  • PyMISP: Python API for MISP feed management and IOC submission

Common Pitfalls

  • IOC age staleness: IP addresses and domains rotate frequently; applying 1-year-old IOCs generates false positives. Enforce TTL policies.
  • Missing context: Blocking an IOC without understanding the associated campaign or adversary can disrupt legitimate business traffic (e.g., CDN IPs shared with malicious actors).
  • Feed overlap without deduplication: Ingesting the same IOC from five feeds without deduplication inflates indicator counts and SIEM rule complexity.
  • TLP violation: Redistributing RED-classified intelligence outside authorized boundaries violates sharing agreements and trust relationships.
  • Over-blocking on low-confidence indicators: Indicators with confidence below 50 should trigger detection-only rules, not blocking, to avoid operational disruption.

More skills from mukul975/Anthropic-Cybersecurity-Skills

  • Aabusing-dpapi-for-credential-accessExtract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
  • Aabusing-shadow-credentials-for-privescTake over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
  • Aachieving-cmmc-level-2-compliancePrepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.
  • Aacquiring-disk-image-with-dd-and-dcflddCreate forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
  • Aanalyzing-active-directory-acl-abuseDetect dangerous ACL misconfigurations in Active Directory using ldap3
  • Aanalyzing-android-malware-with-apktoolPerform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
  • Danalyzing-api-gateway-access-logs'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
  • Aanalyzing-apt-group-with-mitre-navigatorQuery ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
  • Aanalyzing-azure-activity-logs-for-threats'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query
  • Aanalyzing-bootkit-and-rootkit-samples'Analyzes bootkit and advanced rootkit malware infecting the Master
  • Aanalyzing-browser-forensics-with-hindsightParse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
  • Aanalyzing-campaign-attribution-evidenceSystematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

All agent skills → · MCP servers