threat-intelligence
Collect, qualify, enrich and share cyber threat intelligence. Extracts and refangs IOCs (hashes, IPs, domains, URLs, e-mails, mutexes, YARA rule names) from reports, queries and feeds MISP (attributes/events restSearch, warninglists, sightings) and OpenCTI (GraphQL indicators, observables, relationships), reads and builds STIX 2.1 bundles and TAXII 2.1 collections, maps TTPs to MITRE ATT&CK with navigator layers, applies TLP sharing rules, confidence and aging, and enriches with VirusTotal, Shodan, abuse.ch, GreyNoise and AbuseIPDB within their rate limits.
When to use
Use when the user asks to "extract the IOCs from this report", "search MISP for this hash", "summarize this STIX bundle", "map this campaign to ATT&CK", "push these indicators to OpenCTI", or pastes a CERT advisory with defanged indicators. In French "extraire les IOC", "rechercher dans MISP", "cartographier sur ATT&CK".
Inputs and tools
The skill takes the request of the user in natural language: its frontmatter declares no argument. It declares no allowed-tools: the tools available are those of the agent that loads it, under the tool policy of the project.
Reference
| Field | Value |
|---|---|
| Name | threat-intelligence |
| Category | Security |
| Version | Not declared |
| Licence | Not declared |
| Allowed tools | Not declared |
| Plugins | - |
| Source | catalog/navin/skills/threat-intelligence/SKILL.md |
| Digest | sha256:64dad4a8ba59cb3c7522950d7a0658c6b7097e325828399cbaa56a735023c197 |
skill_md_digest | sha256:23973f82e16bb593e67840931885a82c686c22dec1e4331a767b54ff32419e03 |
| Emoji | 🕵️ |
Bundled files
| Path | Count |
|---|---|
catalog/navin/skills/threat-intelligence/examples | 2 |
catalog/navin/skills/threat-intelligence/references | 3 |
catalog/navin/skills/threat-intelligence/scripts | 2 |
Frontmatter
Every field of the SKILL.md frontmatter, with the value of the source:
| Field | Value |
|---|---|
name | threat-intelligence |
description | Collect, qualify, enrich and share cyber threat intelligence. Extracts and refangs IOCs (hashes, IPs, domains, URLs, e-mails, mutexes, YARA rule names) from reports, queries and feeds MISP (attributes/events restSearch, warninglists, sightings) and OpenCTI (GraphQL indicators, observables, relationships), reads and builds STIX 2.1 bundles and TAXII 2.1 collections, maps TTPs to MITRE ATT&CK with navigator layers, applies TLP sharing rules, confidence and aging, and enriches with VirusTotal, Shodan, abuse.ch, GreyNoise and AbuseIPDB within their rate limits. Use when the user asks to "extract the IOCs from this report", "search MISP for this hash", "summarize this STIX bundle", "map this campaign to ATT&CK", "push these indicators to OpenCTI", or pastes a CERT advisory with defanged indicators. In French "extraire les IOC", "rechercher dans MISP", "cartographier sur ATT&CK". |
metadata.navin.emoji | 🕵️ |
metadata.navin.category | security |