[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESFQ7QAB6MN334G5ZDNKBX":3,"skill-same:01M6ESFQ7QAB6MN334G5ZDNKBX":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6ESFQ7QAB6MN334G5ZDNKBX","building-threat-intelligence-enrichment-in-splunk",null,"Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"enrichment","intelligence","threat","building threat intelligence enrichment in splunk","splunk","threat intelligence","threat-intelligence","ioc","soc","modular","Enterprise","security","enterprise-security","lookup","SOC-operations","operations","siem","pipelines","build","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-threat-intelligence-enrichment-in-splunk\ndescription: Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags: [splunk, threat-intelligence, enrichment, ioc, lookup, siem, soc, enterprise-security]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Building Threat Intelligence Enrichment in Splunk\n\n## Overview\n\nSplunk's Threat Intelligence Framework in Enterprise Security enables SOC teams to automatically correlate indicators of compromise (IOCs) against security events. The framework ingests threat feeds, normalizes indicators into KV Store collections, and uses lookup-based correlation searches to flag matching events. Splunk Threat Intelligence Management centralizes collection, normalization, and enrichment from multiple sources, reducing triage time by providing analysts with immediate context.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence enrichment in splunk capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Splunk Enterprise Security (ES) 7.x or later\n- Threat Intelligence Management add-on or Threat Intelligence Framework\n- API keys for external threat intelligence feeds (MISP, OTX, VirusTotal, AbuseIPDB)\n- KV Store enabled and properly configured\n- Admin access for modular input configuration\n\n## Threat Intelligence Framework Architecture\n\n```\nExternal TI Sources (STIX\u002FTAXII, CSV, API)\n    |\n    v\nModular Inputs (download and parse feeds)\n    |\n    v\nKV Store Collections (normalized IOC storage)\n    |-- ip_intel\n    |-- domain_intel\n    |-- file_intel\n    |-- url_intel\n    |-- email_intel\n    |\n    v\nThreat Intelligence Lookups\n    |\n    v\nCorrelation Searches (match events against IOCs)\n    |\n    v\nNotable Events (enriched with TI context)\n```\n\n## Configuring Threat Intelligence Sources\n\n### STIX\u002FTAXII Feed Integration\n\n```conf\n# inputs.conf - TAXII feed configuration\n[threatlist:\u002F\u002Ftaxii_feed_example]\ndescription = TAXII 2.1 Threat Feed\ntype = taxii\nurl = https:\u002F\u002Fthreatfeed.example.com\u002Ftaxii2\u002F\ncollection = threat-indicators-v21\npolling_interval = 3600\napi_key = \u003Cencrypted_api_key>\ndisabled = false\n```\n\n### CSV-Based Threat List\n\n```conf\n# inputs.conf - CSV threat list\n[threatlist:\u002F\u002Fcustom_blocklist]\ndescription = Internal threat blocklist\ntype = csv\nurl = https:\u002F\u002Finternal.company.com\u002Fthreat-feeds\u002Fblocklist.csv\npolling_interval = 1800\ndisabled = false\n```\n\n### Custom Modular Input for API-Based Feeds\n\n```python\n# bin\u002Fthreatfeed_otx.py - OTX AlienVault feed collector\nimport json\nimport sys\nimport requests\nfrom splunklib.modularinput import Script, Scheme, Argument, Event\n\n\nclass OTXFeedInput(Script):\n    def get_scheme(self):\n        scheme = Scheme(\"OTX AlienVault Feed\")\n        scheme.description = \"Collects IOCs from AlienVault OTX\"\n        scheme.use_external_validation = False\n        scheme.streaming_mode = Scheme.streaming_mode_xml\n\n        api_key_arg = Argument(\"api_key\")\n        api_key_arg.data_type = Argument.data_type_string\n        api_key_arg.required_on_create = True\n        scheme.add_argument(api_key_arg)\n\n        pulse_days_arg = Argument(\"pulse_days\")\n        pulse_days_arg.data_type = Argument.data_type_number\n        pulse_days_arg.required_on_create = False\n        scheme.add_argument(pulse_days_arg)\n\n        return scheme\n\n    def stream_events(self, inputs, ew):\n        for input_name, input_item in inputs.inputs.items():\n            api_key = input_item[\"api_key\"]\n            pulse_days = int(input_item.get(\"pulse_days\", 30))\n\n            headers = {\"X-OTX-API-KEY\": api_key}\n            url = f\"https:\u002F\u002Fotx.alienvault.com\u002Fapi\u002Fv1\u002Fpulses\u002Fsubscribed?modified_since={pulse_days}d\"\n\n            try:\n                response = requests.get(url, headers=headers, timeout=60)\n                response.raise_for_status()\n                data = response.json()\n\n                for pulse in data.get(\"results\", []):\n                    for indicator in pulse.get(\"indicators\", []):\n                        event = Event()\n                        event.stanza = input_name\n                        event.data = json.dumps({\n                            \"indicator\": indicator[\"indicator\"],\n                            \"type\": indicator[\"type\"],\n                            \"pulse_name\": pulse[\"name\"],\n                            \"pulse_id\": pulse[\"id\"],\n                            \"description\": indicator.get(\"description\", \"\"),\n                            \"created\": indicator.get(\"created\", \"\"),\n                            \"threat_source\": \"OTX\",\n                            \"confidence\": pulse.get(\"adversary\", \"unknown\"),\n                        })\n                        ew.write_event(event)\n            except requests.RequestException as e:\n                ew.log(\"ERROR\", f\"OTX feed collection failed: {str(e)}\")\n\n\nif __name__ == \"__main__\":\n    sys.exit(OTXFeedInput().run(sys.argv))\n```\n\n## Building Enrichment Lookups\n\n### KV Store Collection Configuration\n\n```conf\n# collections.conf\n[ip_threat_intel]\nfield.ip = string\nfield.threat_type = string\nfield.confidence = number\nfield.source = string\nfield.description = string\nfield.first_seen = time\nfield.last_seen = time\nfield.severity = string\n\n[domain_threat_intel]\nfield.domain = string\nfield.threat_type = string\nfield.confidence = number\nfield.source = string\nfield.whois_registrar = string\nfield.whois_created = string\n\n[file_hash_intel]\nfield.file_hash = string\nfield.hash_type = string\nfield.malware_family = string\nfield.confidence = number\nfield.source = string\nfield.detection_names = string\n```\n\n### Lookup Table Definitions\n\n```conf\n# transforms.conf\n[ip_threat_intel_lookup]\nexternal_type = kvstore\ncollection = ip_threat_intel\nfields_list = ip, threat_type, confidence, source, description, severity\n\n[domain_threat_intel_lookup]\nexternal_type = kvstore\ncollection = domain_threat_intel\nfields_list = domain, threat_type, confidence, source\n\n[file_hash_intel_lookup]\nexternal_type = kvstore\ncollection = file_hash_intel\nfields_list = file_hash, hash_type, malware_family, confidence, source\n```\n\n## Enrichment Correlation Searches\n\n### IP-Based Threat Intelligence Correlation\n\n```spl\n| tstats summariesonly=true count from datamodel=Network_Traffic\n    where All_Traffic.action=allowed\n    by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port, _time span=5m\n| rename \"All_Traffic.*\" as *\n| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence, source as ti_source, severity as ti_severity\n| where isnotnull(threat_type)\n| lookup asset_lookup ip as src_ip OUTPUT asset_name, asset_owner, asset_priority\n| eval urgency=case(\n    ti_severity==\"critical\" AND asset_priority==\"critical\", \"critical\",\n    ti_severity==\"high\" OR asset_priority==\"critical\", \"high\",\n    ti_severity==\"medium\", \"medium\",\n    true(), \"low\"\n)\n| eval description=\"Connection from \".src_ip.\" (\".asset_name.\") to known malicious IP \".dest_ip.\" (\".threat_type.\") - Source: \".ti_source\n```\n\n### Domain-Based Threat Intelligence Correlation\n\n```spl\nindex=dns sourcetype=stream:dns query_type=A OR query_type=AAAA\n| lookup domain_threat_intel_lookup domain as query OUTPUT threat_type as domain_threat, confidence as domain_confidence, source as ti_source\n| where isnotnull(domain_threat) AND domain_confidence > 70\n| stats count dc(src_ip) as unique_sources values(src_ip) as source_ips by query, domain_threat, ti_source\n| eval severity=case(domain_confidence > 90, \"critical\", domain_confidence > 70, \"high\", true(), \"medium\")\n| eval description=\"DNS queries to malicious domain \".query.\" from \".unique_sources.\" hosts - Threat: \".domain_threat\n```\n\n### File Hash Correlation\n\n```spl\nindex=endpoint sourcetype=sysmon EventCode=1\n| lookup file_hash_intel_lookup file_hash as Hashes OUTPUT malware_family, confidence as hash_confidence, source as ti_source\n| where isnotnull(malware_family)\n| stats count values(ParentCommandLine) as parent_commands by Computer, User, Image, malware_family, ti_source\n| eval severity=\"critical\"\n| eval description=\"Known malware \".malware_family.\" executed on \".Computer.\" by \".User.\" - Binary: \".Image\n```\n\n## Multi-Source Enrichment Pipeline\n\n```spl\nindex=firewall sourcetype=pan:traffic action=allowed\n| eval indicators=mvappend(src_ip, dest_ip)\n| mvexpand indicators\n| lookup ip_threat_intel_lookup ip as indicators OUTPUT threat_type as ip_threat, confidence as ip_confidence, source as ip_ti_source\n| lookup geo_ip_lookup ip as indicators OUTPUT country, city, latitude, longitude\n| lookup whois_lookup ip as indicators OUTPUT org as ip_org, asn as ip_asn\n| where isnotnull(ip_threat)\n| stats count\n    values(ip_threat) as threat_types\n    values(ip_ti_source) as intel_sources\n    values(country) as countries\n    values(ip_org) as organizations\n    latest(_time) as last_seen\n    earliest(_time) as first_seen\n    by src_ip, dest_ip, dest_port\n| eval enrichment_context=\"Threat: \".mvjoin(threat_types, \", \").\" | Geo: \".mvjoin(countries, \", \").\" | Org: \".mvjoin(organizations, \", \")\n```\n\n## Threat Intelligence Dashboards\n\n### IOC Coverage Statistics\n\n```spl\n| inputlookup ip_threat_intel_lookup\n| stats count by source, threat_type\n| sort -count\n| head 20\n```\n\n### Feed Freshness Monitoring\n\n```spl\n| inputlookup ip_threat_intel_lookup\n| eval age_days=round((now() - strptime(last_seen, \"%Y-%m-%dT%H:%M:%S\")) \u002F 86400, 0)\n| stats count avg(age_days) as avg_age_days max(age_days) as max_age_days by source\n| eval status=case(avg_age_days > 30, \"STALE\", avg_age_days > 7, \"AGING\", true(), \"FRESH\")\n```\n\n## References\n\n- [Splunk Threat Intelligence Framework Documentation](https:\u002F\u002Fhelp.splunk.com\u002Fen\u002Fsplunk-enterprise-security-8\u002Fadminister\u002F8.2\u002Fthreat-intelligence\u002Foverview-of-threat-intelligence-in-splunk-enterprise-security)\n- [Splunk Lantern - Threat Intelligence Enrichment](https:\u002F\u002Flantern.splunk.com\u002FSecurity\u002FUCE\u002FGuided_Insights\u002FThreat_intelligence)\n- [Integrated Intelligence Enrichment - Splunk Blog](https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fblog\u002Fsecurity\u002Fintegrated-intelligence-enrichment-with-threat-intelligence-management.html)\n- [Cisco Talos Threat Intelligence in Splunk](https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fblog\u002Fsecurity\u002Fcisco-talos-threat-intelligence-splunk-security.html)\n","# Building Threat Intelligence Enrichment in Splunk\n\n## Overview\n\nSplunk's Threat Intelligence Framework in Enterprise Security enables SOC teams to automatically correlate indicators of compromise (IOCs) against security events. The framework ingests threat feeds, normalizes indicators into KV Store collections, and uses lookup-based correlation searches to flag matching events. Splunk Threat Intelligence Management centralizes collection, normalization, and enrichment from multiple sources, reducing triage time by providing analysts with immediate context.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence enrichment in splunk capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Splunk Enterprise Security (ES) 7.x or later\n- Threat Intelligence Management add-on or Threat Intelligence Framework\n- API keys for external threat intelligence feeds (MISP, OTX, VirusTotal, AbuseIPDB)\n- KV Store enabled and properly configured\n- Admin access for modular input configuration\n\n## Threat Intelligence Framework Architecture\n\n```\nExternal TI Sources (STIX\u002FTAXII, CSV, API)\n    |\n    v\nModular Inputs (download and parse feeds)\n    |\n    v\nKV Store Collections (normalized IOC storage)\n    |-- ip_intel\n    |-- domain_intel\n    |-- file_intel\n    |-- url_intel\n    |-- email_intel\n    |\n    v\nThreat Intelligence Lookups\n    |\n    v\nCorrelation Searches (match events against IOCs)\n    |\n    v\nNotable Events (enriched with TI context)\n```\n\n## Configuring Threat Intelligence Sources\n\n### STIX\u002FTAXII Feed Integration\n\n```conf\n# inputs.conf - TAXII feed configuration\n[threatlist:\u002F\u002Ftaxii_feed_example]\ndescription = TAXII 2.1 Threat Feed\ntype = taxii\nurl = https:\u002F\u002Fthreatfeed.example.com\u002Ftaxii2\u002F\ncollection = threat-indicators-v21\npolling_interval = 3600\napi_key = \u003Cencrypted_api_key>\ndisabled = false\n```\n\n### CSV-Based Threat List\n\n```conf\n# inputs.conf - CSV threat list\n[threatlist:\u002F\u002Fcustom_blocklist]\ndescription = Internal threat blocklist\ntype = csv\nurl = https:\u002F\u002Finternal.company.com\u002Fthreat-feeds\u002Fblocklist.csv\npolling_interval = 1800\ndisabled = false\n```\n\n### Custom Modular Input for API-Based Feeds\n\n```python\n# bin\u002Fthreatfeed_otx.py - OTX AlienVault feed collector\nimport json\nimport sys\nimport requests\nfrom splunklib.modularinput import Script, Scheme, Argument, Event\n\n\nclass OTXFeedInput(Script):\n    def get_scheme(self):\n        scheme = Scheme(\"OTX AlienVault Feed\")\n        scheme.description = \"Collects IOCs from AlienVault OTX\"\n        scheme.use_external_validation = False\n        scheme.streaming_mode = Scheme.streaming_mode_xml\n\n        api_key_arg = Argument(\"api_key\")\n        api_key_arg.data_type = Argument.data_type_string\n        api_key_arg.required_on_create = True\n        scheme.add_argument(api_key_arg)\n\n        pulse_days_arg = Argument(\"pulse_days\")\n        pulse_days_arg.data_type = Argument.data_type_number\n        pulse_days_arg.required_on_create = False\n        scheme.add_argument(pulse_days_arg)\n\n        return scheme\n\n    def stream_events(self, inputs, ew):\n        for input_name, input_item in inputs.inputs.items():\n            api_key = input_item[\"api_key\"]\n            pulse_days = int(input_item.get(\"pulse_days\", 30))\n\n            headers = {\"X-OTX-API-KEY\": api_key}\n            url = f\"https:\u002F\u002Fotx.alienvault.com\u002Fapi\u002Fv1\u002Fpulses\u002Fsubscribed?modified_since={pulse_days}d\"\n\n            try:\n                response = requests.get(url, headers=headers, timeout=60)\n                response.raise_for_status()\n                data = response.json()\n\n                for pulse in data.get(\"results\", []):\n                    for indicator in pulse.get(\"indicators\", []):\n                        event = Event()\n                        event.stanza = input_name\n                        event.data = json.dumps({\n                            \"indicator\": indicator[\"indicator\"],\n                            \"type\": indicator[\"type\"],\n                            \"pulse_name\": pulse[\"name\"],\n                            \"pulse_id\": pulse[\"id\"],\n                            \"description\": indicator.get(\"description\", \"\"),\n                            \"created\": indicator.get(\"created\", \"\"),\n                            \"threat_source\": \"OTX\",\n                            \"confidence\": pulse.get(\"adversary\", \"unknown\"),\n                        })\n                        ew.write_event(event)\n            except requests.RequestException as e:\n                ew.log(\"ERROR\", f\"OTX feed collection failed: {str(e)}\")\n\n\nif __name__ == \"__main__\":\n    sys.exit(OTXFeedInput().run(sys.argv))\n```\n\n## Building Enrichment Lookups\n\n### KV Store Collection Configuration\n\n```conf\n# collections.conf\n[ip_threat_intel]\nfield.ip = string\nfield.threat_type = string\nfield.confidence = number\nfield.source = string\nfield.description = string\nfield.first_seen = time\nfield.last_seen = time\nfield.severity = string\n\n[domain_threat_intel]\nfield.domain = string\nfield.threat_type = string\nfield.confidence = number\nfield.source = string\nfield.whois_registrar = string\nfield.whois_created = string\n\n[file_hash_intel]\nfield.file_hash = string\nfield.hash_type = string\nfield.malware_family = string\nfield.confidence = number\nfield.source = string\nfield.detection_names = string\n```\n\n### Lookup Table Definitions\n\n```conf\n# transforms.conf\n[ip_threat_intel_lookup]\nexternal_type = kvstore\ncollection = ip_threat_intel\nfields_list = ip, threat_type, confidence, source, description, severity\n\n[domain_threat_intel_lookup]\nexternal_type = kvstore\ncollection = domain_threat_intel\nfields_list = domain, threat_type, confidence, source\n\n[file_hash_intel_lookup]\nexternal_type = kvstore\ncollection = file_hash_intel\nfields_list = file_hash, hash_type, malware_family, confidence, source\n```\n\n## Enrichment Correlation Searches\n\n### IP-Based Threat Intelligence Correlation\n\n```spl\n| tstats summariesonly=true count from datamodel=Network_Traffic\n    where All_Traffic.action=allowed\n    by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port, _time span=5m\n| rename \"All_Traffic.*\" as *\n| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence, source as ti_source, severity as ti_severity\n| where isnotnull(threat_type)\n| lookup asset_lookup ip as src_ip OUTPUT asset_name, asset_owner, asset_priority\n| eval urgency=case(\n    ti_severity==\"critical\" AND asset_priority==\"critical\", \"critical\",\n    ti_severity==\"high\" OR asset_priority==\"critical\", \"high\",\n    ti_severity==\"medium\", \"medium\",\n    true(), \"low\"\n)\n| eval description=\"Connection from \".src_ip.\" (\".asset_name.\") to known malicious IP \".dest_ip.\" (\".threat_type.\") - Source: \".ti_source\n```\n\n### Domain-Based Threat Intelligence Correlation\n\n```spl\nindex=dns sourcetype=stream:dns query_type=A OR query_type=AAAA\n| lookup domain_threat_intel_lookup domain as query OUTPUT threat_type as domain_threat, confidence as domain_confidence, source as ti_source\n| where isnotnull(domain_threat) AND domain_confidence > 70\n| stats count dc(src_ip) as unique_sources values(src_ip) as source_ips by query, domain_threat, ti_source\n| eval severity=case(domain_confidence > 90, \"critical\", domain_confidence > 70, \"high\", true(), \"medium\")\n| eval description=\"DNS queries to malicious domain \".query.\" from \".unique_sources.\" hosts - Threat: \".domain_threat\n```\n\n### File Hash Correlation\n\n```spl\nindex=endpoint sourcetype=sysmon EventCode=1\n| lookup file_hash_intel_lookup file_hash as Hashes OUTPUT malware_family, confidence as hash_confidence, source as ti_source\n| where isnotnull(malware_family)\n| stats count values(ParentCommandLine) as parent_commands by Computer, User, Image, malware_family, ti_source\n| eval severity=\"critical\"\n| eval description=\"Known malware \".malware_family.\" executed on \".Computer.\" by \".User.\" - Binary: \".Image\n```\n\n## Multi-Source Enrichment Pipeline\n\n```spl\nindex=firewall sourcetype=pan:traffic action=allowed\n| eval indicators=mvappend(src_ip, dest_ip)\n| mvexpand indicators\n| lookup ip_threat_intel_lookup ip as indicators OUTPUT threat_type as ip_threat, confidence as ip_confidence, source as ip_ti_source\n| lookup geo_ip_lookup ip as indicators OUTPUT country, city, latitude, longitude\n| lookup whois_lookup ip as indicators OUTPUT org as ip_org, asn as ip_asn\n| where isnotnull(ip_threat)\n| stats count\n    values(ip_threat) as threat_types\n    values(ip_ti_source) as intel_sources\n    values(country) as countries\n    values(ip_org) as organizations\n    latest(_time) as last_seen\n    earliest(_time) as first_seen\n    by src_ip, dest_ip, dest_port\n| eval enrichment_context=\"Threat: \".mvjoin(threat_types, \", \").\" | Geo: \".mvjoin(countries, \", \").\" | Org: \".mvjoin(organizations, \", \")\n```\n\n## Threat Intelligence Dashboards\n\n### IOC Coverage Statistics\n\n```spl\n| inputlookup ip_threat_intel_lookup\n| stats count by source, threat_type\n| sort -count\n| head 20\n```\n\n### Feed Freshness Monitoring\n\n```spl\n| inputlookup ip_threat_intel_lookup\n| eval age_days=round((now() - strptime(last_seen, \"%Y-%m-%dT%H:%M:%S\")) \u002F 86400, 0)\n| stats count avg(age_days) as avg_age_days max(age_days) as max_age_days by source\n| eval status=case(avg_age_days > 30, \"STALE\", avg_age_days > 7, \"AGING\", true(), \"FRESH\")\n```\n\n## References\n\n- [Splunk Threat Intelligence Framework Documentation](https:\u002F\u002Fhelp.splunk.com\u002Fen\u002Fsplunk-enterprise-security-8\u002Fadminister\u002F8.2\u002Fthreat-intelligence\u002Foverview-of-threat-intelligence-in-splunk-enterprise-security)\n- [Splunk Lantern - Threat Intelligence Enrichment](https:\u002F\u002Flantern.splunk.com\u002FSecurity\u002FUCE\u002FGuided_Insights\u002FThreat_intelligence)\n- [Integrated Intelligence Enrichment - Splunk Blog](https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fblog\u002Fsecurity\u002Fintegrated-intelligence-enrichment-with-threat-intelligence-management.html)\n- [Cisco Talos Threat Intelligence in Splunk](https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fblog\u002Fsecurity\u002Fcisco-talos-threat-intelligence-splunk-security.html)\n",{"name":5,"tags":44,"author":45,"domain":38,"license":15,"version":46,"subdomain":47,"description":7},[23,25,19,26,32,35,27,31],"mahipal","1.0","soc-operations","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk",1,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-threat-intelligence-enrichment-in-splunk",{"tool":62,"command":63},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-threat-intelligence-enrichment-in-splunk",{"tool":65,"command":66},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-threat-intelligence-enrichment-in-splunk","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002FSKILL.md",true,[70,76,81,87,91,95,101],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"assets\u002Ftemplate.md","ASSET","资产文件",1333,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002Fassets\u002Ftemplate.md",{"path":77,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002FLICENSE",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fapi-reference.md","REFERENCE","参考文档",2008,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002Freferences\u002Fapi-reference.md",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fstandards.md",1416,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002Freferences\u002Fstandards.md",{"path":92,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fworkflows.md",1714,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002Freferences\u002Fworkflows.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",6688,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002Fscripts\u002Fagent.py",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fprocess.py",10310,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-enrichment-in-splunk\u002Fscripts\u002Fprocess.py",[106,134,151,180,213,250],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[141,142,143,144,145,146,147,148,149,150],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":162,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[157],{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[37,163,164,165,166,167,168,169,142,170,171,172,114,173,174,175,176,177,178,179],"solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":192,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":190,"categoryName":191,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000009","前端开发",[193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":231,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[219,222,225,226],{"categoryNo":220,"categoryName":221,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":223,"categoryName":224,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},{"categoryNo":227,"categoryName":228,"taxonomyType":229,"taxonomyTypeDesc":230},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":256,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[171,257,258,259,260,261,262,120,263,264,265,266,267,206,268,269,212,270],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]