Skill UI

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

This skill guides the implementation of a full Cyber Threat Intelligence (CTI) program across the six-phase intelligence lifecycle. It covers defining intelligence requirements (PIRs), building collection pipelines, normalizing data, performing analysis, and managing feedback loops. Ideal for maturing existing CTI teams or establishing foundational security intelligence capabilities.

This skill guides the end-to-end management of the Cyber Threat Intelligence (CTI) lifecycle. It covers defining Priority Intelligence Requirements (PIRs), planning data collection, processing data, performing multi-level analysis (Strategic, Operational, Tactical), disseminating tailored reports, and establishing continuous feedback loops to ensure intelligence relevance and maturity.

This skill guides the systematic management of Indicators of Compromise (IOCs). It covers the entire lifecycle, from initial discovery and validation through enrichment (e.g., VirusTotal, Shodan) and deployment to SIEM/IDS. Key features include confidence decay over time, false positive tracking, and automated retirement policies, ensuring the threat intelligence database remains high-quality and actionable.

This skill utilizes PyMISP, the official library, to programmatically manage the lifecycle of threat intelligence within a MISP instance. Users can create structured events containing Indicators of Compromise (IOCs) such as IPs, domains, and hashes, enrich these events with MITRE ATT&CK tags, manage sharing groups, and export the collected data in standardized STIX 2.1 format. Ideal for security assessments, incident response, and integrating external IOC feeds.