Skill UI

This skill details the architecture and implementation of an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. It demonstrates how to connect OpenCTI to various external threat intelligence services (like VirusTotal, Shodan, AbuseIPDB) to automatically gather context, correlate indicators, and assign confidence scores. This is crucial for enhancing security monitoring and prioritizing threats for cyber analysts.

A comprehensive guide on building a unified Threat Intelligence Platform (TIP). This skill covers deploying and integrating multiple core CTI tools (MISP, OpenCTI, TheHive, Cortex) into a single system. Learn to design the architecture, configure feed ingestion pipelines, automate IOC enrichment, and ensure standardized intelligence sharing using STIX/TAXII standards.

This guide demonstrates how to use the pycti Python client to model complex cyber threat intelligence within the OpenCTI platform. It structures threat actors, intrusion sets, campaigns, and TTPs into a unified STIX 2.1 knowledge graph. The skill is essential for correlating fragmented data from multiple sources (IOCs, reports) into a comprehensive, queryable adversary picture, supporting advanced threat hunting and detection engineering.