What it does. 'Analyzes structured and unstructured threat intelligence feeds to extract Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-threat-intelligence-feeds, or copy the skill folder into ~/.claude/skills/analyzing-threat-intelligence-feeds/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-intelligence-feeds/SKILL.md

SKILL.md (verbatim)

name: analyzing-threat-intelligence-feeds
description: 'Analyzes structured and unstructured threat intelligence feeds to extract
  actionable indicators, adversary tactics, and campaign context. Use when ingesting
  commercial or open-source CTI feeds, evaluating feed quality, normalizing data into
  STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates
  for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP,
  AlienVault OTX, or automated feed aggregation pipelines.

  '
domain: cybersecurity
subdomain: threat-intelligence
tags:
- STIX
- TAXII
- MITRE-ATT&CK
- IOC
- ThreatConnect
- Recorded-Future
- MISP
- CTI
- NIST-CSF
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1071.001
- T1566
- T1568
- T1583.001
- T1102

Analyzing Threat Intelligence Feeds

When to Use

Use this skill when:

• Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio
• Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema
• Evaluating feed freshness, fidelity, and relevance to the organization's threat profile
• Building automated enrichment pipelines that correlate IOCs against SIEM events

Do not use this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline.

Prerequisites

• Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI
• API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise)
• TAXII 2.1 client library (taxii2-client Python package or equivalent)
• Role with read/write permissions to the TIP's indicator database

Workflow

Step 1: Enumerate and Prioritize Feed Sources

List all available feeds categorized by type (commercial, government, ISAC, OSINT):

• Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence
• Government: CISA AIS (Automated Indicator Sharing), FBI InfraGard, MS-ISAC
• OSINT: AlienVault OTX, Abuse.ch, PhishTank, Emerging Threats

Score each feed on: update frequency, historical accuracy rate, coverage of your sector, and attribution depth. Use a weighted scoring matrix with criteria from NIST SP 800-150 (Guide to Cyber Threat Information Sharing).

Step 2: Ingest via TAXII 2.1 or API

For TAXII-enabled feeds:

taxii2-client discover https://feed.example.com/taxii/
taxii2-client get-collection --collection-id <id> --since 2024-01-01

For REST API feeds (e.g., Recorded Future):

• Query /v2/indicator/search with risk_score_min=65 to filter low-confidence IOCs
• Apply rate limiting and exponential backoff for API resilience

Step 3: Normalize to STIX 2.1

Convert each IOC to STIX 2.1 objects using the OASIS standard schema:

• IP address → indicator object with pattern: "[ipv4-addr:value = '...']"
• Domain → indicator with pattern: "[domain-name:value = '...']"
• File hash → indicator with pattern: "[file:hashes.SHA-256 = '...']"

Attach relationship objects linking indicators to threat-actor or malware objects. Use confidence field (0–100) based on source fidelity rating.

Step 4: Deduplicate and Enrich

Run deduplication against existing TIP database using normalized value + type as composite key. Enrich surviving IOCs:

• VirusTotal: detection ratio, sandbox behavior reports
• PassiveTotal (RiskIQ): WHOIS history, passive DNS, SSL certificate chains
• Shodan: banner data, open ports, geographic location

Step 5: Distribute to Consuming Systems

Export enriched indicators via TAXII 2.1 push to SIEM (Splunk, Microsoft Sentinel), firewalls (Palo Alto XSOAR playbooks), and EDR platforms. Set TTL (time-to-live) per indicator type: IP addresses 30 days, domains 90 days, file hashes 1 year.

Key Concepts

Tools & Systems

• ThreatConnect TC Exchange: Aggregates 100+ commercial and OSINT feeds; provides automated playbooks for IOC enrichment
• MISP (Malware Information Sharing Platform): Open-source TIP supporting STIX/TAXII; widely used by ISACs and government CERTs
• OpenCTI: Open-source platform with native MITRE ATT&CK integration and graph-based relationship visualization
• Recorded Future: Commercial feed with AI-powered risk scoring and real-time dark web monitoring
• taxii2-client: Python library for TAXII 2.0/2.1 client operations (pip install taxii2-client)
• PyMISP: Python API for MISP feed management and IOC submission

Common Pitfalls

• IOC age staleness: IP addresses and domains rotate frequently; applying 1-year-old IOCs generates false positives. Enforce TTL policies.
• Missing context: Blocking an IOC without understanding the associated campaign or adversary can disrupt legitimate business traffic (e.g., CDN IPs shared with malicious actors).
• Feed overlap without deduplication: Ingesting the same IOC from five feeds without deduplication inflates indicator counts and SIEM rule complexity.
• TLP violation: Redistributing RED-classified intelligence outside authorized boundaries violates sharing agreements and trust relationships.
• Over-blocking on low-confidence indicators: Indicators with confidence below 50 should trigger detection-only rules, not blocking, to avoid operational disruption.

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: Analyzing Threat Intelligence Feeds

taxii2-client

Server Discovery

from taxii2client.v21 import Server

server = Server("https://cti.example.com/taxii2/", user="u", password="p")
for api_root in server.api_roots:
    for col in api_root.collections:
        print(col.id, col.title)

Fetch Indicators from Collection

from taxii2client.v21 import Collection, as_pages

collection = Collection(
    "https://cti.example.com/taxii2/collections/abc123/",
    user="u", password="p"
)
for bundle in as_pages(collection.get_objects, per_request=100):
    for obj in bundle.get("objects", []):
        if obj["type"] == "indicator":
            print(obj["pattern"])

Push Indicators

collection.add_objects(stix_bundle_json)

stix2 (Python Library)

Create Indicator

from stix2 import Indicator

indicator = Indicator(
    name="Malicious IP",
    pattern="[ipv4-addr:value = '1.2.3.4']",
    pattern_type="stix",
    valid_from="2025-01-01T00:00:00Z",
    confidence=85,
)

Create Bundle and Serialize

from stix2 import Bundle
bundle = Bundle(objects=[indicator])
print(bundle.serialize(pretty=True))

MemoryStore for Querying

from stix2 import MemoryStore, Filter
store = MemoryStore(stix_data=bundle)
results = store.query([Filter("type", "=", "indicator")])

STIX 2.1 Pattern Syntax

TAXII 2.1 HTTP Endpoints

References

• taxii2-client: https://pypi.org/project/taxii2-client/
• stix2 library: https://pypi.org/project/stix2/
• STIX 2.1 spec: https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html
• TAXII 2.1 spec: https://docs.oasis-open.org/cti/taxii/v2.1/taxii-v2.1.html

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.