Skill UI

This skill guides the creation of automated workflows for enriching raw Indicators of Compromise (IOCs) with multi-source threat intelligence context. It is designed for integration into SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR) or Python pipelines. By automatically querying multiple sources like VirusTotal, AbuseIPDB, and MISP, it significantly reduces analyst mean time to triage (MTTT) and standardizes the resulting threat context and confidence scoring.

This guide details the deployment and configuration of MISP (Malware Information Sharing Platform) using Docker. It demonstrates how to aggregate, correlate, and distribute threat intelligence from diverse sources like abuse.ch and AlienVault OTX. Learn automated feed synchronization, STIX/TAXII integration, and connecting the platform to SIEM and SOAR tools like Splunk and Elasticsearch for centralized IOC management.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.

This skill automates the entire phishing incident response workflow using the Splunk SOAR REST API. It parses suspicious emails, creates incident containers, attaches artifacts (URLs, IPs, headers), triggers automated investigation playbooks, and compiles a comprehensive security verdict. It is designed for security operations teams building robust, automated incident response capabilities.