Skill UI

Guidance for automating Virustotal tasks through Composio’s toolkit on Rube MCP, covering discovery, connection management, schema-aware execution, and workflow best practices.

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This skill provides a comprehensive framework for ingesting, normalizing, and enriching threat intelligence (CTI) from multiple structured and unstructured sources. It guides users through scoring feeds, converting heterogeneous IOC formats (like OpenIOC, YARA) into the standardized STIX 2.1 format, and enriching indicators using external services (e.g., VirusTotal, PassiveTotal). Ideal for building robust, automated threat detection pipelines for SIEM and EDR systems.

This skill guides the creation of automated workflows for enriching raw Indicators of Compromise (IOCs) with multi-source threat intelligence context. It is designed for integration into SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR) or Python pipelines. By automatically querying multiple sources like VirusTotal, AbuseIPDB, and MISP, it significantly reduces analyst mean time to triage (MTTT) and standardizes the resulting threat context and confidence scoring.

This skill details the architecture and implementation of an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. It demonstrates how to connect OpenCTI to various external threat intelligence services (like VirusTotal, Shodan, AbuseIPDB) to automatically gather context, correlate indicators, and assign confidence scores. This is crucial for enhancing security monitoring and prioritizing threats for cyber analysts.

This skill guides the implementation of Security Orchestration, Automation, and Response (SOAR) workflows using platforms like Splunk Phantom. It automates the entire incident lifecycle, including alert triage, IOC enrichment (via VirusTotal, CrowdStrike), containment actions, and ticket creation (ServiceNow). Ideal for SOC teams needing to reduce Mean Time To Respond (MTTR) and standardize complex security procedures across multiple tools.

Build a PyMISP-driven threat intelligence platform that ingests multiple IOC feeds, tags MITRE ATT&CK techniques, enriches data via VirusTotal and AbuseIPDB, and exports STIX 2.1 bundles for SIEM pipelines.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

This skill automates the enrichment of Indicators of Compromise (IOCs) by orchestrating lookups across multiple industry-leading threat intelligence sources (e.g., VirusTotal, AbuseIPDB, Shodan). It provides contextual scoring and disposition recommendations for IPs, domains, URLs, and hashes. Ideal for SOC analysts during alert triage or incident investigation to quickly assess risk and scope.

This skill leverages the VirusTotal API to perform comprehensive threat intelligence enrichment on file hashes (MD5, SHA-1, SHA-256). It retrieves detection rates from 70+ AV engines, behavioral sandbox reports, associated indicators of compromise (IOCs), and contextual threat data. Use this tool for rapid SOC triage, accurate incident response validation, and enhancing threat hunting workflows.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.