114 skills · sorted by relevance
Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.
Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.
Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.
Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.
Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting
The English summary is being prepared. Showing the original description.
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
The English summary is being prepared. Showing the original description.
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat
The English summary is being prepared. Showing the original description.
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T
The English summary is being prepared. Showing the original description.
Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
The English summary is being prepared. Showing the original description.
Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.
The English summary is being prepared. Showing the original description.
Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
The English summary is being prepared. Showing the original description.
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat
The English summary is being prepared. Showing the original description.
Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.
The English summary is being prepared. Showing the original description.
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T
The English summary is being prepared. Showing the original description.
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat
The English summary is being prepared. Showing the original description.
Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
The English summary is being prepared. Showing the original description.
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T
The English summary is being prepared. Showing the original description.
Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.
The English summary is being prepared. Showing the original description.
Investigate suspicious domains, scams, impersonation, and malicious activity using public sources. Preserve source details, check leads against independent evidence, and prepare a threat intelligence handoff that records confidence, verification status, and remaining gaps.
Evaluate threat intelligence platforms, which collect and organize cyber threat information. Define requirements, compare integrations and operating costs, plan practical trials, and use weighted scoring to select a platform and outline its rollout.
Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.
Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.
Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.
Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.