Skill UI

Automate ingestion, normalization, defanging, STIX enrichment, and TAXII/MISP distribution of raw IoCs to safely share threat intelligence across teams and platforms.

Analyzes malware to extract file hashes, C2 domains, IPs, URLs, registry hits and behavioral artifacts, blending static PE parsing, sandbox detonations, YARA-based IOC spotting, and STIX 2.1 formatting for CTI sharing during assessments or incident response.

This skill guides the programmatic creation, enrichment, and secure sharing of threat intelligence within a MISP platform. Using the official PyMISP Python library, users can manage Indicators of Compromise (IOCs), apply MITRE ATT&CK tags, configure sharing groups, and export structured data in STIX 2.1 format. It is essential for security assessments, incident response, and automated threat intelligence pipelines.