Skill UI

Leverage Certificate Transparency (CT) logs via crt.sh and Certstream to proactively monitor for suspicious SSL/TLS certificates. This skill helps detect lookalike domains, unauthorized certificate issuance, and potential phishing infrastructure targeting your organization before attacks launch. Includes querying logic and threat intelligence integration.

This skill enables deep analysis of malware families using the Malpedia API. It allows users to retrieve canonical aliases, associated threat actors, and YARA detection rules, and map complex relationships like loader-payload chains. Ideal for threat intelligence research, incident response, and building automated detection signatures.

This skill provides a comprehensive framework for ingesting, normalizing, and enriching threat intelligence (CTI) from multiple structured and unstructured sources. It guides users through scoring feeds, converting heterogeneous IOC formats (like OpenIOC, YARA) into the standardized STIX 2.1 format, and enriching indicators using external services (e.g., VirusTotal, PassiveTotal). Ideal for building robust, automated threat detection pipelines for SIEM and EDR systems.

This skill guides the creation of automated workflows for enriching raw Indicators of Compromise (IOCs) with multi-source threat intelligence context. It is designed for integration into SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR) or Python pipelines. By automatically querying multiple sources like VirusTotal, AbuseIPDB, and MISP, it significantly reduces analyst mean time to triage (MTTT) and standardizes the resulting threat context and confidence scoring.

This skill parses various cyber threat intelligence (CTI) reports (Mandiant, CrowdStrike, etc.) using NLP and specialized libraries (stix2, mitreattack-python, spaCy). It systematically extracts adversary behaviors, maps them to MITRE ATT&CK IDs, and constructs a searchable STIX 2.1 Attack Pattern library. This is essential for threat-informed detection engineering, generating detection rules (Sigma, YARA), and validating security controls.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

This pipeline provides an automated solution for processing raw Indicators of Compromise (IOCs) from various sources, including IPs, domains, URLs, and emails. It performs crucial steps such as normalization, deduplication, and defanging (modifying indicators to prevent accidental execution while preserving readability). The final, processed data is converted into the standardized STIX 2.1 format and can be securely distributed via TAXII servers or MISP instances, streamlining threat intelligence sharing.

This solution guides the implementation of a phishing reporting button within email clients, creating a critical feedback loop for security teams. By integrating with SOAR platforms, reported suspicious emails undergo automated triage, including IOC extraction, sandbox analysis, and threat intelligence checks. The workflow enables rapid classification, automated remediation (e.g., mass retraction, sender blocking), and provides detailed feedback to the user reporter, significantly enhancing overall security posture.

This guide details the deployment and configuration of MISP (Malware Information Sharing Platform) using Docker. It demonstrates how to aggregate, correlate, and distribute threat intelligence from diverse sources like abuse.ch and AlienVault OTX. Learn automated feed synchronization, STIX/TAXII integration, and connecting the platform to SIEM and SOAR tools like Splunk and Elasticsearch for centralized IOC management.

This framework guides the systematic process of proactive threat hunting. It transforms raw threat intelligence and ATT&CK gap analyses into concrete, testable hypotheses. Users execute these hypotheses using industry-standard EDR/SIEM platforms (Splunk, CrowdStrike, Defender, etc.) to validate potential compromises, correlate activity, and document findings in a standardized report format.

A comprehensive guide to building automated Indicator of Compromise (IOC) enrichment pipelines within Splunk Enterprise Security. This process integrates multiple external threat feeds (STIX/TAXII, CSV, APIs) into normalized KV Store collections. By correlating these enriched threat indicators against live security events using advanced lookup searches, SOC teams can significantly reduce manual triage time and automatically identify potential security incidents.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.