811 skills · sorted by relevance
Analyze threat intelligence stored in MISP, a platform for sharing security threat data. Summarize event counts, indicator types, attacker groups, and trends over time to create a threat landscape report for a chosen period.
Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.
Build a threat model that identifies valuable assets, attack entry points, potential threats, and mitigation priorities. Use source code and past vulnerabilities, an interview with the application owner, or a combination of both.
Generate a read-only security report on threats involving MCP connections and operations. It groups findings by threat, reports the highest severity, and supports table or JSON output with a configurable severity threshold for failure.
Identify security threats in system designs using STRIDE, a method covering six threat categories. Use structured questions to review components, prioritize threats by impact, and document findings and possible safeguards.
Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.
Analyze a codebase to identify valuable assets, attack entry points, and realistic abuse paths. Produce a concise Markdown threat model that explains risk priorities, distinguishes existing protections from proposed mitigations, and makes assumptions explicit.
Analyze a codebase to identify valuable assets, attack entry points, and realistic abuse paths. Produce a concise Markdown threat model that explains risk priorities, distinguishes existing protections from proposed mitigations, and makes assumptions explicit.
Create a Markdown threat model grounded in a codebase. Identify valuable assets, boundaries between trusted and untrusted components, realistic attack paths, and mitigations, then prioritize risks using explicit assumptions about likelihood and impact.
[omh] Attack paths into an operated system: turn a system's components and data flows into assets, trust boundaries, attack scenarios, controls, and the security test that proves each control holds. Use when the user says: application-threat-model, application threat model, threat model, threat modeling, threat modelling, threat modeling session, threat modeling workshop, security threat model.
The English summary is being prepared. Showing the original description.
Write a threat model document. Use when the user says "threat model", "threat modeling", "STRIDE analysis", "attack surface analysis", "security design review", "what are the threats to this system", "adversarial analysis", "identify threats", "security threat assessment", or needs to systematically identify and document threats to a system or feature - even if they don't explicitly say "threat model".
The English summary is being prepared. Showing the original description.
Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.
Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.
Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.
Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.
Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.
Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.
Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.
Create, update, or reuse a repository threat model: a document describing its architecture, attacker capabilities, trust boundaries, and potential security failures. The result is a Markdown reference grounded in the repository's actual code and scope.
Analyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type breakdowns, identify top threat actors and malware families, and generate threat landscape reports with temporal trends.
The English summary is being prepared. Showing the original description.
Retrieve current cyber threat data, including malware indicators, addresses of attacker control servers, and vulnerabilities known to be exploited. Filter by threat type, source, severity, and date to identify relevant threats for review and reporting.
Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.
Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.
Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.