Skill UI

This skill guides the full lifecycle of threat intelligence processing, transforming raw indicators of compromise (IOCs) from MISP feeds into actionable security detections. It covers feed curation, false positive reduction using warninglists, and automating the generation of high-fidelity rules for Suricata, Sigma, and Wazuh. Use this to mature your MISP instance from a repository into a proactive detection engine.

This agent analyzes a Monte Carlo monitor's report and configuration to identify alert patterns. It recommends concrete configuration changes for metric, custom SQL, validation, and table monitors, helping reduce false positives and alert fatigue without sacrificing real signal.

This skill is designed to mitigate false-positive safety triggers from strict AI classifiers (e.g., cyber, bio/chem, reasoning). It operates by making minimal, surgical edits to sensitive phrases, abstracting away specific domains or actions while preserving the original benign intent and structure. It ensures the prompt remains policy-compliant without losing its core purpose, making it ideal for academic or defensive inquiries.