433 skills · sorted by relevance
Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.
Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.
The English summary is being prepared. Showing the original description.
Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.
The English summary is being prepared. Showing the original description.
Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.
The English summary is being prepared. Showing the original description.
Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.
Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.
Retrieve financial data for market and company analysis, including stocks, forex, crypto, financial statements, and economic indicators. Access over 20 years of historical data and more than 50 technical indicators, which summarize price and trading patterns.
Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.
Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.
Build a workflow that extracts and deduplicates threat indicators such as URLs and IP addresses, creates readable reports with links disabled, and prepares standardized STIX 2.1 data for sharing through MISP or TAXII.
Analyze threat intelligence feeds to extract indicators of compromise, observable clues of possible attacks, and their campaign context. Assess source quality, standardize formats, remove duplicates, and enrich indicators for distribution to security monitoring systems.
Analyze price and volume data using trend indicators, overbought and oversold measures, and volume changes. Combine these three perspectives into a single long, short, or stand-aside signal, with adjustable calculation periods and thresholds.
Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.
Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.
Collect and update 68 US economic and social indicators, then summarize trends over ten, five, two, and one years. Produce a report covering relationships between indicators, unusual patterns, and topics that warrant further research.
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
The English summary is being prepared. Showing the original description.
Pivots on indicators of compromise across multiple data sources by correlating a seed set of IOCs against logs to find co-occurring indicators, hosts, and timeframes that expand the investigation. Activates for requests to pivot on IOCs, correlate indicators across data sources, or expand an investigation from a seed indicator set.
The English summary is being prepared. Showing the original description.
Retrieve current cyber threat data, including malware indicators, addresses of attacker control servers, and vulnerabilities known to be exploited. Filter by threat type, source, severity, and date to identify relevant threats for review and reporting.
Review CSS focus indicators, the visible outlines that show which element receives keyboard input. Identify missing, clipped, or misplaced indicators, check contrast and responsive states, and guide changes that make keyboard navigation easier to follow.
Translate a Python trading strategy or written trading rules into code for TradingView, 通达信, 同花顺, 东方财富, and MT5. Receive platform-specific indicators or strategy code, setup instructions, and notes explaining features that cannot be translated directly.
Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.
Analyze Zeek and NetFlow records for ransomware-related activity, including regular callbacks to attacker infrastructure, TOR connections, and possible data exfiltration. Combine indicators into risk scores and structured reports with timelines to support threat hunting and incident investigation.
Investigate hidden attacker activity using focused hypotheses, indicators of compromise such as malicious domains, and statistical checks on logs. Rank investigation priorities, generate indicator sweep targets, and flag unusual behavior for human review.
Search Google SecOps events for threats that have not triggered alerts. Test attack hypotheses, check historical records for compromise indicators, and examine unusual activity, then document findings and add them to relevant security cases.