Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-indicator-lifecycle-management/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: None
+description: Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes f
+domain: cybersecurity
+subdomain: threat-intelligence
+tags: [threat-intelligence, cti, ioc, mitre-attack, stix, indicator-lifecycle, ioc-management]
+version: "1.0"
+author: mahipal
+license: MIT
+---
+# Performing Indicator Lifecycle Management
+
+## Overview
+
+Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.
+
+## Prerequisites
+
+- Python 3.9+ with `pymisp`, `requests`, `stix2` libraries
+- MISP or OpenCTI instance for indicator storage
+- SIEM with IOC watchlist capabilities (Splunk, Elastic)
+- Understanding of IOC types, confidence scoring, and TLP classifications
+
+## Key Concepts
+
+### Indicator Lifecycle Phases
+1. **Discovery**: IOC first identified from threat intelligence, malware analysis, or incident response
+2. **Validation**: IOC verified against enrichment sources (VirusTotal, Shodan)
+3. **Enrichment**: Additional context added (WHOIS, passive DNS, threat actor attribution)
+4. **Deployment**: IOC pushed to detection systems (SIEM, IDS, firewall)
+5. **Monitoring**: Track hit rates, false positive rates, detection efficacy
+6. **Review**: Periodic assessment of IOC relevance and accuracy
+7. **Retirement**: IOC expired or removed based on aging policy
+
+### Confidence Decay
+Indicator confidence decreases over time as adversaries rotate infrastructure. A time-based decay function reduces confidence scores automatically, ensuring old indicators do not generate excessive alerts. Typical half-life: IP addresses (30 days), domains (90 days), file hashes (365 days).
+
+### Quality Metrics
+- **Hit Rate**: Percentage of deployed IOCs generating true positive alerts
+- **False Positive Rate**: Percentage of IOC alerts that are benign
+- **Coverage**: Percentage of known threat techniques with IOC coverage
+- **Freshness**: Average age of active indicators in the database
+
+## Practical Steps
+
+### Step 1: Implement IOC Lifecycle State Machine
+
+```python
+from datetime import datetime, timedelta
+from enum import Enum
+
+class IOCState(Enum):
+    DISCOVERED = "discovered"
+    VALIDATED = "validated"
+    ENRICHED = "enriched"
+    DEPLOYED = "deployed"
+    MONITORING = "monitoring"
+    UNDER_REVIEW = "under_review"
+    RETIRED = "retired"
+
+class IOCLifecycle:
+    def __init__(self, ioc_type, value, source, initial_confidence=50):
+        self.ioc_type = ioc_type
+        self.value = value
+        self.source = source
+        self.confidence = initial_confidence
+        self.state = IOCState.DISCOVERED
+        self.created = datetime.utcnow()
+        self.last_updated = datetime.utcnow()
+        self.last_seen = None
+        self.hit_count = 0
+        self.false_positive_count = 0
+        self.history = [{"state": "discovered", "timestamp": self.created.isoformat()}]
+
+    def transition(self, new_state: IOCState, reason=""):
+        self.state = new_state
+        self.last_updated = datetime.utcnow()
+        self.history.append({
+            "state": new_state.value,
+            "timestamp": self.last_updated.isoformat(),
+            "reason": reason,
+        })
+
+    def apply_decay(self):
+        """Apply confidence decay based on IOC type half-life."""
+        half_lives = {"ip": 30, "domain": 90, "hash": 365, "url": 60}
+        half_life = half_lives.get(self.ioc_type, 90)
+        age_days = (datetime.utcnow() - self.created).days
+        decay_factor = 0.5 ** (age_days / half_life)
+        self.confidence = max(0, int(self.confidence * decay_factor))
+
+    def record_hit(self, is_true_positive=True):
+        self.hit_count += 1
+        self.last_seen = datetime.utcnow()
+        if not is_true_positive:
+            self.false_positive_count += 1
+            if self.false_positive_count > 3:
+                self.transition(IOCState.UNDER_REVIEW, "Excessive false positives")
+
+    def should_retire(self):
+        max_ages = {"ip": 90, "domain": 180, "hash": 730, "url": 120}
+        max_age = max_ages.get(self.ioc_type, 180)
+        age_days = (datetime.utcnow() - self.created).days
+        return age_days > max_age and self.hit_count == 0
+```
+
+## Validation Criteria
+
+- IOC lifecycle state machine transitions correctly between phases
+- Confidence decay reduces scores based on IOC type half-life
+- Hit rate and false positive tracking functional
+- Aging policy automatically flags indicators for review/retirement
+- Quality metrics dashboard shows IOC database health
+
+## References
+
+- [MISP Indicator Lifecycle](https://www.misp-project.org/)
+- [STIX Indicator Valid From/Until](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)
+- [IOC Quality Framework](https://www.first.org/)

skills/performing-indicator-lifecycle-management/assets/template.md

@@ -0,0 +1,39 @@
+# Indicator Lifecycle Management Report Template
+
+## Report Metadata
+| Field | Value |
+|-------|-------|
+| Report ID | CTI-YYYY-NNNN |
+| Date | YYYY-MM-DD |
+| Classification | TLP:AMBER |
+| Analyst | [Name] |
+| Confidence | High/Moderate/Low |
+
+## Executive Summary
+[Brief overview of key findings and their significance]
+
+## Key Findings
+1. [Finding 1 with supporting evidence]
+2. [Finding 2 with supporting evidence]
+3. [Finding 3 with supporting evidence]
+
+## Detailed Analysis
+### Finding 1
+- **Evidence**: [Description of evidence]
+- **Confidence**: High/Moderate/Low
+- **MITRE ATT&CK**: [Relevant technique IDs]
+- **Impact Assessment**: [Potential impact to organization]
+
+## Indicators of Compromise
+| Type | Value | Context | Confidence |
+|------|-------|---------|-----------|
+| | | | |
+
+## Recommendations
+1. **Immediate**: [Actions requiring immediate attention]
+2. **Short-term**: [Actions within 1-2 weeks]
+3. **Long-term**: [Strategic improvements]
+
+## References
+- [Source 1]
+- [Source 2]

skills/performing-indicator-lifecycle-management/references/standards.md

@@ -0,0 +1,24 @@
+# Standards and Frameworks Reference
+
+## Applicable Standards
+- **STIX 2.1**: Structured Threat Information eXpression for CTI data representation
+- **TAXII 2.1**: Transport protocol for sharing CTI over HTTPS
+- **MITRE ATT&CK**: Adversary tactics, techniques, and procedures taxonomy
+- **Diamond Model**: Intrusion analysis framework (Adversary, Capability, Infrastructure, Victim)
+- **Traffic Light Protocol (TLP)**: Information sharing classification (CLEAR, GREEN, AMBER, RED)
+
+## MITRE ATT&CK Relevance
+- Technique mapping for threat actor behavior classification
+- Data sources for detection capability assessment
+- Mitigation strategies linked to specific techniques
+
+## Industry Frameworks
+- NIST Cybersecurity Framework (CSF) 2.0 - Identify function
+- ISO 27001:2022 - A.5.7 Threat Intelligence
+- FIRST Standards - TLP, CSIRT, vulnerability coordination
+
+## References
+- [STIX 2.1 Specification](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)
+- [MITRE ATT&CK](https://attack.mitre.org/)
+- [Diamond Model Paper](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)
+- [NIST CSF 2.0](https://www.nist.gov/cyberframework)

skills/performing-indicator-lifecycle-management/references/workflows.md

@@ -0,0 +1,31 @@
+# Indicator Lifecycle Management Workflows
+
+## Workflow 1: Collection and Analysis
+```
+[Intelligence Sources] --> [Data Collection] --> [Analysis] --> [Reporting]
+        |                        |                   |               |
+        v                        v                   v               v
+  OSINT/HUMINT/SIGINT    Normalize/Enrich    Assess/Correlate  Disseminate
+```
+
+### Steps:
+1. **Planning**: Define intelligence requirements and collection priorities
+2. **Collection**: Gather data from relevant sources
+3. **Processing**: Normalize data formats and filter noise
+4. **Analysis**: Apply analytical frameworks and correlate findings
+5. **Production**: Generate intelligence products and reports
+6. **Dissemination**: Share with stakeholders via appropriate channels
+7. **Feedback**: Collect consumer feedback to refine future collection
+
+## Workflow 2: Continuous Monitoring
+```
+[Watchlist] --> [Automated Monitoring] --> [Change Detection] --> [Alert/Update]
+```
+
+### Steps:
+1. **Define Watchlist**: Identify indicators, actors, and topics to monitor
+2. **Configure Monitoring**: Set up automated collection from relevant sources
+3. **Change Detection**: Identify new or changed intelligence
+4. **Assessment**: Evaluate significance of changes
+5. **Alerting**: Notify stakeholders of significant intelligence updates
+6. **Archive**: Store intelligence for historical analysis and trending

skills/performing-indicator-lifecycle-management/scripts/process.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""
+Indicator Lifecycle Management Script
+
+Manages IOC lifecycle: discovery, validation, deployment, monitoring, retirement.
+
+Requirements: pip install requests
+
+Usage:
+    python process.py --import-iocs iocs.csv --output lifecycle_db.json
+    python process.py --decay --db lifecycle_db.json
+    python process.py --review --db lifecycle_db.json --output review_report.json
+"""
+
+import argparse
+import csv
+import json
+import sys
+from datetime import datetime, timedelta
+
+
+class IOCLifecycleManager:
+    def __init__(self):
+        self.indicators = {}
+
+    def add_indicator(self, ioc_type, value, source, confidence=50):
+        key = f"{ioc_type}:{value}"
+        self.indicators[key] = {
+            "type": ioc_type, "value": value, "source": source,
+            "confidence": confidence, "state": "discovered",
+            "created": datetime.utcnow().isoformat(),
+            "last_updated": datetime.utcnow().isoformat(),
+            "hit_count": 0, "fp_count": 0, "last_seen": None,
+        }
+
+    def apply_decay(self):
+        half_lives = {"ip": 30, "domain": 90, "hash": 365, "url": 60, "email": 180}
+        for key, ioc in self.indicators.items():
+            if ioc["state"] == "retired":
+                continue
+            hl = half_lives.get(ioc["type"], 90)
+            age = (datetime.utcnow() - datetime.fromisoformat(ioc["created"])).days
+            decay = 0.5 ** (age / hl)
+            ioc["confidence"] = max(0, int(ioc["confidence"] * decay))
+            if ioc["confidence"] < 10:
+                ioc["state"] = "under_review"
+
+    def review_indicators(self):
+        review = {"retire": [], "keep": [], "boost": []}
+        for key, ioc in self.indicators.items():
+            age = (datetime.utcnow() - datetime.fromisoformat(ioc["created"])).days
+            max_ages = {"ip": 90, "domain": 180, "hash": 730, "url": 120}
+            max_age = max_ages.get(ioc["type"], 180)
+
+            if age > max_age and ioc["hit_count"] == 0:
+                review["retire"].append(key)
+                ioc["state"] = "retired"
+            elif ioc["fp_count"] > 3:
+                review["retire"].append(key)
+                ioc["state"] = "retired"
+            elif ioc["hit_count"] > 5:
+                review["boost"].append(key)
+                ioc["confidence"] = min(100, ioc["confidence"] + 10)
+            else:
+                review["keep"].append(key)
+        return review
+
+    def get_stats(self):
+        states = {}
+        for ioc in self.indicators.values():
+            states[ioc["state"]] = states.get(ioc["state"], 0) + 1
+        return {
+            "total": len(self.indicators),
+            "by_state": states,
+            "avg_confidence": (
+                sum(i["confidence"] for i in self.indicators.values()) / len(self.indicators)
+                if self.indicators else 0
+            ),
+        }
+
+    def load(self, filepath):
+        with open(filepath) as f:
+            self.indicators = json.load(f)
+
+    def save(self, filepath):
+        with open(filepath, "w") as f:
+            json.dump(self.indicators, f, indent=2)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="IOC Lifecycle Manager")
+    parser.add_argument("--import-iocs", help="CSV file with IOCs")
+    parser.add_argument("--decay", action="store_true", help="Apply confidence decay")
+    parser.add_argument("--review", action="store_true", help="Review indicators")
+    parser.add_argument("--stats", action="store_true", help="Show statistics")
+    parser.add_argument("--db", default="lifecycle_db.json", help="Database file")
+    parser.add_argument("--output", default="lifecycle_report.json")
+    args = parser.parse_args()
+
+    mgr = IOCLifecycleManager()
+    try:
+        mgr.load(args.db)
+    except FileNotFoundError:
+        pass
+
+    if args.import_iocs:
+        with open(args.import_iocs) as f:
+            reader = csv.DictReader(f)
+            for row in reader:
+                mgr.add_indicator(
+                    row.get("type", "ip"), row.get("value", ""),
+                    row.get("source", "import"), int(row.get("confidence", 50)),
+                )
+        mgr.save(args.db)
+
+    if args.decay:
+        mgr.apply_decay()
+        mgr.save(args.db)
+
+    if args.review:
+        result = mgr.review_indicators()
+        mgr.save(args.db)
+        print(json.dumps(result, indent=2))
+
+    if args.stats:
+        print(json.dumps(mgr.get_stats(), indent=2))
+
+
+if __name__ == "__main__":
+    main()