Download

Skill UI

Browse and discover 6034+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Threat-Intelligence , found 25 results

Default Newest Most Downloaded

Command-and-Control Analysis

analyzing-command-and-control-communication

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware command-and-control (C2) communication by profiling protocols, beaconing behavior, and payload structure to inform detection, reverse engineering, and threat intelligence workflows.

Automated IOC Enrichment

automating-ioc-enrichment

mukul975/Anthropic-Cybersecurity-Skills

Automates IOC enrichment by orchestrating multi-source threat intelligence via SOAR playbooks or Python pipelines so SIEM alerts, email submissions, and bulk feeds pre-populate analyst context with VirusTotal, Shodan, MISP, AbuseIPDB, and TIP data.

Sigma Detection Rule Builder

building-detection-rules-with-sigma

mukul975/Anthropic-Cybersecurity-Skills

Creates portable Sigma detection rules from threat intelligence, validating syntax and converting to Splunk, Elastic, or Sentinel queries so SOC teams can map rules to MITRE ATT&CK and reuse them in CI/CD pipelines.

Threat Actor Profiling OSINT

building-threat-actor-profile-from-osint

mukul975/Anthropic-Cybersecurity-Skills

Use OSINT sources, Maltego/SpiderFoot, and STIX data to gather open‑source intelligence, map adversary infrastructure and TTPs, and deliver structured threat actor dossiers for proactive defense.

MISP Threat Feed Aggregation

building-threat-feed-aggregation-with-misp

mukul975/Anthropic-Cybersecurity-Skills

Deploys MISP via Docker and PyMISP to aggregate, correlate, and distribute threat intelligence feeds from OSINT and commercial sources, enabling centralized IOC management, automated SIEM/SOAR integration, and synchronized sharing across communities.

Threat Hunt Hypothesis

building-threat-hunt-hypothesis-framework

mukul975/Anthropic-Cybersecurity-Skills

Establishes a systematic process that turns threat intelligence, ATT&CK gaps, and telemetry into testable hunting hypotheses, guiding analysts through data selection, query execution, and reporting for proactive detection and response.

Splunk Threat Intelligence Enrichment

building-threat-intelligence-enrichment-in-splunk

mukul975/Anthropic-Cybersecurity-Skills

Automate threat intelligence enrichment in Splunk Enterprise Security by ingesting feeds through modular inputs, normalizing IOCs into KV Store collections, and correlating them via lookups to highlight contextual notables for SOC triage.

Threat Intelligence Feed Integration

building-threat-intelligence-feed-integration

mukul975/Anthropic-Cybersecurity-Skills

Automates ingestion, normalization, scoring, and distribution of STIX/TAXII and open-source threat feeds so SOCs can match IOCs in real time across SIEM and detection tools.

Threat Intelligence Platform Build

building-threat-intelligence-platform

mukul975/Anthropic-Cybersecurity-Skills

Guides building a unified Threat Intelligence Platform by orchestrating CTI tools like MISP, OpenCTI, TheHive, Cortex, and shared storage/enrichment services via Docker Compose and API integrations.

Compromise Indicator Collector

collecting-indicators-of-compromise

mukul975/Anthropic-Cybersecurity-Skills

Systematically collects and enriches IOCs from SIEM logs, memory analysis, and malware reports, then translates them into STIX/TAXII for defensive systems and trusted partners to detect, block, and share threat intelligence.

Threat Campaign Correlation

correlating-threat-campaigns

mukul975/Anthropic-Cybersecurity-Skills

Correlates disparate incidents, IOCs, and adversary behaviors using infrastructure, capability, temporal, and victimology pivots to build campaign graphs and intelligence reports for detection tuning and attribution.

Insider Threat Detection

detecting-insider-threat-behaviors

mukul975/Anthropic-Cybersecurity-Skills

Detects insider threat behaviors by hunting for unusual data access, privilege abuse, mass downloads, and resignation-linked exfiltration across EDR, SIEM, and intelligence sources to guide incident response actions.

Language