mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-24 05:30:58 +03:00
mukul975
c47eed6a64
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
45 lines
1.6 KiB
Markdown
45 lines
1.6 KiB
Markdown
---
|
|
name: implementing-threat-intelligence-platform
|
|
description: >-
|
|
Build a MISP-backed threat intelligence platform that ingests IOCs from multiple feeds,
|
|
correlates events with galaxy clusters, and enriches indicators via VirusTotal and AbuseIPDB.
|
|
Uses PyMISP to create events, add attributes with IDS flags, tag with MITRE ATT&CK techniques,
|
|
and export STIX 2.1 bundles for downstream SIEM consumption.
|
|
domain: cybersecurity
|
|
subdomain: threat-intelligence
|
|
tags: [implementing, threat, intelligence, platform]
|
|
version: "1.0"
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
---
|
|
|
|
## Instructions
|
|
|
|
1. Install dependencies: `pip install pymisp requests stix2`
|
|
2. Deploy MISP instance and generate an API key from Administration > Auth Keys.
|
|
3. Use PyMISP to connect and create threat intelligence events:
|
|
- Create events with threat level, distribution, and analysis status
|
|
- Add attributes (ip-dst, domain, sha256, url) with to_ids flags
|
|
- Tag events with MITRE ATT&CK technique identifiers
|
|
- Correlate events across organizations
|
|
4. Ingest from external feeds: URLhaus, Feodo Tracker, MalwareBazaar.
|
|
5. Enrich IOCs via VirusTotal and AbuseIPDB APIs.
|
|
6. Export correlated events as STIX 2.1 bundles.
|
|
|
|
```bash
|
|
python scripts/agent.py --misp-url https://misp.local --misp-key <api_key> --ingest-feeds --output misp_report.json
|
|
```
|
|
|
|
## Examples
|
|
|
|
### Create MISP Event with IOCs
|
|
```python
|
|
from pymisp import PyMISP, MISPEvent, MISPAttribute
|
|
misp = PyMISP("https://misp.local", "api_key")
|
|
event = MISPEvent()
|
|
event.info = "Phishing Campaign - 2024-Q1"
|
|
event.threat_level_id = 2
|
|
event.add_attribute("ip-dst", "185.143.223.47", to_ids=True)
|
|
misp.add_event(event)
|
|
```
|