New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Collecting Threat Intelligence With Misp

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines…

Apache-2.0Auto-check: notesSecurity

Install Collecting Threat Intelligence With Misp

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-threat-intelligence-with-misp -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills collecting-threat-intelligence-with-misp --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/collecting-threat-intelligence-with-misp .claude/skills/collecting-threat-intelligence-with-misp && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
collecting-threat-intelligence-with-misp
GitHub stars
34k
Token cost
~1.6k tokens
SKILL.md length
400 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines…

  • Works in 5 steps: Deploy MISP with Docker → Configure Default Feeds → Add Custom Threat Feeds → …
  • Correlating IOCs and threat intelligence
  • SKILL.md covers Overview, When to Use, Prerequisites and Key Concepts, plus 3 more sections
  • Runs Python scripts from its folder; calls git and docker; reaches github.com and urlhaus.abuse.ch

What it does

Collecting Threat Intelligence With Misp is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering OSINT. It works with Docker. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Correlating IOCs and threat intelligence
  • Scripting MISP ingestion via PyMISP

Example prompts

  • “/collecting-threat-intelligence-with-misp”

Requirements

  • Python 3
  • Docker
  • A credential in YOUR_API_KEY

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Deploy MISP with Docker
  2. Configure Default Feeds
  3. Add Custom Threat Feeds
  4. Programmatic Event Search and Retrieval
  5. Export IOCs for Downstream Tools

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • git
    • docker

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com
    • urlhaus.abuse.ch

    Also links to:

    • misp-project.org
    • pymisp.readthedocs.io
    • circl.lu

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Collecting Threat Intelligence With Misp loads about 1.6k tokens when it runs, and up to ~3.8k if it reads all its reference files. Until then it costs about 106 tokens; SKILL.md has 400 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~106
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:76
    cp template.env .env
  • NoteMentions a .env fileSKILL.md:77
    # Edit .env to set MISP_BASEURL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSPHRASE

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 400 words, ~1,559 tokens.

Download SKILL.mdSave it as .claude/skills/collecting-threat-intelligence-with-misp/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
collecting-threat-intelligence-with-misp
description
Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.
domain
cybersecurity
subdomain
threat-intelligence
tags
threat-intelligence, cti, ioc, mitre-attack, stix, misp, taxii, threat-sharing
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
ID.RA-01, ID.RA-05, DE.CM-01, DE.AE-02
mitre_attack
T1071.001, T1588.001, T1583.001, T1566.001, T1587.001

Collecting Threat Intelligence with MISP

Overview

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or counter-terrorism information. This skill covers deploying MISP, configuring threat feeds, using the PyMISP API for programmatic access, and building automated collection pipelines that aggregate IOCs from multiple community and commercial sources.

When to Use

  • When managing security operations that require collecting threat intelligence with misp
  • When improving security program maturity and operational processes
  • When establishing standardized procedures for security team workflows
  • When integrating threat intelligence or vulnerability data into operations

Prerequisites

  • Python 3.9+ with pymisp library installed
  • Docker and Docker Compose for MISP deployment
  • Understanding of STIX 2.1 and TAXII 2.1 protocols
  • Familiarity with IOC types: hashes, IP addresses, domains, URLs, email addresses
  • Network access to MISP community feeds (circl.lu, botvrij.eu)

Key Concepts

MISP Architecture

MISP operates on an event-based model where threat intelligence is organized into events containing attributes (IOCs), objects (structured groupings of attributes), galaxies (threat actor/malware clusters linked to MITRE ATT&CK), and tags for classification. Synchronization between MISP instances uses a pull/push model over HTTPS with API key authentication.

Feed Types
  • MISP Feeds: Native JSON/CSV feeds from MISP community (CIRCL OSINT, botvrij.eu)
  • Freetext Feeds: Unstructured text feeds parsed for IOCs (abuse.ch, Feodo Tracker)
  • TAXII Feeds: STIX/TAXII 2.1 compatible feeds from commercial and government sources
  • CSV Feeds: Structured CSV feeds with configurable column mapping
Show full SKILL.md (156 more words)Show less
PyMISP API

PyMISP is the official Python library to access MISP platforms via their REST API. It supports fetching events, adding/updating events and attributes, uploading samples, and searching across the entire MISP dataset. Authentication uses an API key passed in the Authorization header.

Workflow

Step 1: Deploy MISP with Docker
bash
git clone https://github.com/MISP/misp-docker.git
cd misp-docker
cp template.env .env
# Edit .env to set MISP_BASEURL, MISP_ADMIN_EMAIL, MISP_ADMIN_PASSPHRASE
docker compose up -d
Step 2: Configure Default Feeds

Enable built-in MISP feeds via the web UI or API:

python
from pymisp import PyMISP

misp = PyMISP('https://misp.local', 'YOUR_API_KEY', ssl=False)

# List available feeds
feeds = misp.feeds()
for feed in feeds:
    print(f"{feed['Feed']['id']}: {feed['Feed']['name']} - Enabled: {feed['Feed']['enabled']}")

# Enable CIRCL OSINT Feed
misp.enable_feed(feed_id=1)
misp.cache_feed(feed_id=1)
misp.fetch_feed(feed_id=1)
Step 3: Add Custom Threat Feeds
python
# Add abuse.ch URLhaus feed
feed_data = {
    'name': 'URLhaus Recent URLs',
    'provider': 'abuse.ch',
    'url': 'https://urlhaus.abuse.ch/downloads/csv_recent/',
    'source_format': 'csv',
    'input_source': 'network',
    'publish': False,
    'enabled': True,
    'headers': '',
    'distribution': 0,
    'sharing_group_id': 0,
    'tag_id': 0,
    'default': False,
    'lookup_visible': True
}
result = misp.add_feed(feed_data)
print(f"Feed added: {result}")
Step 4: Programmatic Event Search and Retrieval
python
from pymisp import PyMISP, MISPEvent
from datetime import datetime, timedelta

misp = PyMISP('https://misp.local', 'YOUR_API_KEY', ssl=False)

# Search for events from the last 7 days
result = misp.search(
    controller='events',
    date_from=(datetime.now() - timedelta(days=7)).strftime('%Y-%m-%d'),
    type_attribute='ip-dst',
    to_ids=True,
    pythonify=True
)

for event in result:
    print(f"Event {event.id}: {event.info}")
    for attr in event.attributes:
        if attr.type == 'ip-dst' and attr.to_ids:
            print(f"  IOC: {attr.value} (category: {attr.category})")
Step 5: Export IOCs for Downstream Tools
python
# Export as STIX 2.1 bundle
stix_output = misp.search(
    controller='events',
    return_format='stix2',
    tags=['tlp:white'],
    published=True
)

# Export IDS-flagged attributes as Suricata rules
suricata_rules = misp.search(
    controller='attributes',
    return_format='suricata',
    to_ids=True,
    type_attribute=['ip-dst', 'domain', 'url']
)

# Export as CSV for SIEM ingestion
csv_output = misp.search(
    controller='attributes',
    return_format='csv',
    type_attribute='ip-dst',
    to_ids=True
)

Validation Criteria

  • MISP instance is deployed and accessible via HTTPS
  • At least 3 community feeds are enabled and fetching data successfully
  • PyMISP script can authenticate, search events, and retrieve IOCs
  • Events contain properly tagged and categorized attributes
  • Export to STIX 2.1 produces valid STIX bundles
  • Automated feed fetch runs on schedule (cron or MISP scheduler)

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/collecting-threat-intelligence-with-misp of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Collecting Threat Intelligence With Misp next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Collecting Threat Intelligence With Misp compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Collecting Threat Intelligence With Misp this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.6kAutomated safety check: NotesApache-2.0
SherlockTommy-yw/RunbookHermes5463 repos~1.5kAutomated safety check: PassMIT
Code Audit3stoneBrother/code-audit8921 repos~2.7kAutomated safety check: PassNone
Codeqlelastic/kibana21k—~1.7kAutomated safety check: PassCustom licence
Osintsmixs/osint-skill141—~5.5kAutomated safety check: PassMIT
Triage Image Cvesactivepieces/activepieces25k—~3.6kAutomated safety check: PassCustom licence

Similar skills

  • Sherlock

    Tommy-yw/RunbookHermes

    OSINT username search across 400+ social networks. An agent skill from Tommy-yw/RunbookHermes.

    546 GitHub starsUsed in 3 repos~1.5k tokens
    SecurityAuto-check passed

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    892 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

  • Codeql

    elastic/kibana

    Official

    Work with CodeQL in Kibana — write, test, and debug custom queries locally, fetch scan results from GitHub, and validate inline suppression comments.

    21k GitHub stars~1.7k tokensUpdated today
    SecurityAuto-check passed

  • Osint

    smixs/osint-skill

    Conduct deep OSINT research on individuals. An agent skill from smixs/osint-skill.

    141 GitHub stars~5.5k tokensUpdated 7 mo ago
    SecurityAuto-check passed

  • Triage Image Cves

    activepieces/activepieces

    Scan an Activepieces Docker image with grype for OS/base-image (deb) and application (npm) CVEs of High/Critical severity.

    25k GitHub stars~3.6k tokensUpdated today
    SecurityAuto-check passed

  • Cyberowlai

    karimhabush/cyberowl

    Check if recent cybersecurity alerts from 10 international CERTs affect your current project.

    263 GitHub stars~2.5k tokensUpdated today
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Collecting Threat Intelligence With Misp

What does Collecting Threat Intelligence With Misp do?

Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines…. Collecting Threat Intelligence With Misp is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources.

When should I use Collecting Threat Intelligence With Misp?

Collecting Threat Intelligence With Misp fits situations like: correlating IOCs and threat intelligence; scripting MISP ingestion via PyMISP.

How do I install Collecting Threat Intelligence With Misp in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-threat-intelligence-with-misp -a claude-code`. Or copy the skill folder (skills/collecting-threat-intelligence-with-misp in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/collecting-threat-intelligence-with-misp in your project. Claude Code loads it when a task matches its description.

How do I install Collecting Threat Intelligence With Misp in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-threat-intelligence-with-misp -a codex`. Or copy the skill folder (skills/collecting-threat-intelligence-with-misp in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/collecting-threat-intelligence-with-misp in your project. Codex loads it when a task matches its description.

Can I use Collecting Threat Intelligence With Misp in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-threat-intelligence-with-misp -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/collecting-threat-intelligence-with-misp, .gemini/skills/collecting-threat-intelligence-with-misp, .github/skills/collecting-threat-intelligence-with-misp and .opencode/skills/collecting-threat-intelligence-with-misp in your project.

What does Collecting Threat Intelligence With Misp need to run?

Going by SKILL.md and its folder, Collecting Threat Intelligence With Misp needs Python for the scripts in its folder and the command-line tools its instructions call (git and docker). Our summary lists: Python 3; Docker; A credential in YOUR_API_KEY.

Does Collecting Threat Intelligence With Misp access the network?

SKILL.md names 5 domains. In commands or code: github.com and urlhaus.abuse.ch; the agent is likely to contact these when it follows the instructions. As links in the text: misp-project.org, pymisp.readthedocs.io and circl.lu. This is read from the text; nothing was executed.

Is Collecting Threat Intelligence With Misp safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Collecting Threat Intelligence With Misp use?

Collecting Threat Intelligence With Misp is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Collecting Threat Intelligence With Misp use?

About 1.6k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.3k tokens, read only when the agent opens those files.

What are the alternatives to Collecting Threat Intelligence With Misp?

Skills that share tags, products or a category with Collecting Threat Intelligence With Misp: Sherlock (Tommy-yw/RunbookHermes, 546 stars), Code Audit (3stoneBrother/code-audit, 892 stars), Codeql (elastic/kibana, 21k stars) and Osint (smixs/osint-skill, 141 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Collecting Threat Intelligence With Misp?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.