Skill UI

This system automates the tracking and mapping of threat actor Command-and-Control (C2) networks. By leveraging passive DNS records, WHOIS data, certificate transparency logs, and IP enrichment, it helps security analysts perform infrastructure pivoting. It identifies shared hosting patterns, monitors domain reuse, and continuously maps adversary relationships for proactive threat intelligence.

This skill automates the process of parsing Cyber Threat Intelligence (CTI) reports to extract adversary behaviors. It maps these behaviors to MITRE ATT&CK techniques and structures them as STIX 2.1 Attack Pattern objects. The resulting library supports detection engineering by generating rule templates (Sigma, YARA) for proactive defense and threat-informed security control implementation.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

This skill outlines the development of an automated pipeline to ingest raw Indicators of Compromise (IOCs) from various sources. It performs normalization, defanging (e.g., converting 'http://' to 'hxxp://'), and converts indicators into the standardized STIX 2.1 format. The processed, safe indicators can then be securely distributed via TAXII feeds, MISP, and other threat intelligence platforms.

This skill details the architecture and implementation of an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. It demonstrates how to connect OpenCTI to various external threat intelligence services (like VirusTotal, Shodan, AbuseIPDB) to automatically gather context, correlate indicators, and assign confidence scores. This is crucial for enhancing security monitoring and prioritizing threats for cyber analysts.

This solution guides the implementation of a phishing reporting button within email clients, creating a critical feedback loop for security teams. By integrating with SOAR platforms, reported suspicious emails undergo automated triage, including IOC extraction, sandbox analysis, and threat intelligence checks. The workflow enables rapid classification, automated remediation (e.g., mass retraction, sender blocking), and provides detailed feedback to the user reporter, significantly enhancing overall security posture.

This skill provides a systematic methodology for building comprehensive threat actor profiles using Open-Source Intelligence (OSINT). It involves gathering, correlating, and analyzing publicly available data from diverse sources (e.g., vendor reports, dark web forums, code repositories). Users can map adversary TTPs to MITRE ATT&CK, assess motivations, and build structured dossiers for proactive defensive strategies and attribution assessments.

This guide details the deployment and usage of MISP (Malware Information Sharing Platform) to centralize, correlate, and distribute threat intelligence. It covers architectural concepts, integrating diverse OSINT and commercial feeds (like abuse.ch, AlienVault OTX), and automating the flow of Indicators of Compromise (IOCs) into SIEM and SOAR systems via Docker and Python APIs.

This framework provides a systematic methodology for cybersecurity professionals to transform raw threat intelligence, observed attack patterns, and environmental telemetry into verifiable, testable hunting hypotheses. It guides the end-to-end process, from hypothesis formulation and data identification across SIEM/EDR systems, to deep correlation and reporting, enabling proactive threat detection and scope assessment.

This guide details how to build automated threat intelligence enrichment pipelines within Splunk Enterprise Security. By leveraging the Threat Intelligence Framework, users can ingest, normalize, and correlate Indicators of Compromise (IOCs) from diverse external sources (such as TAXII, CSV, and custom APIs). The process uses KV Store collections and lookup searches to enrich raw security events with critical threat context, significantly reducing triage time for SOC teams.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

A comprehensive guide on building a unified Threat Intelligence Platform (TIP). This skill covers deploying and integrating multiple core CTI tools (MISP, OpenCTI, TheHive, Cortex) into a single system. Learn to design the architecture, configure feed ingestion pipelines, automate IOC enrichment, and ensure standardized intelligence sharing using STIX/TAXII standards.