[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESFZYH0YYCDP82DFK0138N":3,"skill-same:01M6ESFZYH0YYCDP82DFK0138N":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6ESFZYH0YYCDP82DFK0138N","building-threat-intelligence-platform",null,"Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"threat intelligence","platform","intelligence","threat","building threat intelligence platform","ioc","stix","MISP","analyzing","opencti","platform-building","cti","Tools","TIP","system","threat-intelligence","mitre-attack","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-threat-intelligence-platform\ndescription: Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags: [threat-intelligence, cti, ioc, mitre-attack, stix, platform-building, misp, opencti]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Building Threat Intelligence Platform\n\n## Overview\n\nBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX\u002FTAXII interoperability, and building analyst dashboards for CTI operations.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence platform capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deploying platform components\n- Python 3.9+ with `pymisp`, `pycti`, `thehive4py` libraries\n- Elasticsearch\u002FOpenSearch cluster for data storage\n- Redis and RabbitMQ for message queuing\n- Understanding of STIX 2.1 data model and TAXII 2.1 transport\n- API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)\n\n## Key Concepts\n\n### TIP Architecture Components\n1. **Collection Layer**: Feed ingestion from OSINT, commercial, and internal sources\n2. **Storage Layer**: Elasticsearch\u002FOpenSearch for indexed CTI data with STIX 2.1 schema\n3. **Analysis Layer**: OpenCTI for knowledge graph analysis and MISP for IOC correlation\n4. **Enrichment Layer**: Cortex analyzers for automated IOC enrichment\n5. **Response Layer**: TheHive for case management and incident response integration\n6. **Sharing Layer**: TAXII server for outbound intelligence sharing\n\n### Platform Integration Points\n- **MISP \u003C-> OpenCTI**: Bidirectional sync via OpenCTI MISP connector\n- **OpenCTI \u003C-> TheHive**: Alert\u002Fcase creation from high-confidence indicators\n- **TheHive \u003C-> Cortex**: Automated analysis and enrichment of case observables\n- **All \u003C-> SIEM**: Real-time IOC push to Splunk\u002FElastic via API or Kafka\n\n## Workflow\n\n### Step 1: Deploy Platform with Docker Compose\n\n```yaml\nversion: '3.8'\nservices:\n  # --- Storage Layer ---\n  elasticsearch:\n    image: docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.12.0\n    environment:\n      - discovery.type=single-node\n      - xpack.security.enabled=false\n      - \"ES_JAVA_OPTS=-Xms2g -Xmx2g\"\n    ports:\n      - \"9200:9200\"\n    volumes:\n      - es-data:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n\n  redis:\n    image: redis:7\n    ports:\n      - \"6379:6379\"\n\n  rabbitmq:\n    image: rabbitmq:3-management\n    ports:\n      - \"5672:5672\"\n      - \"15672:15672\"\n\n  minio:\n    image: minio\u002Fminio\n    command: server \u002Fdata --console-address \":9001\"\n    ports:\n      - \"9000:9000\"\n      - \"9001:9001\"\n\n  # --- MISP ---\n  misp:\n    image: ghcr.io\u002Fmisp\u002Fmisp-docker\u002Fmisp-core:latest\n    ports:\n      - \"8443:443\"\n    environment:\n      - MISP_ADMIN_EMAIL=admin@tip.local\n      - MISP_BASEURL=https:\u002F\u002Flocalhost:8443\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n\n  # --- OpenCTI ---\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@tip.local\n      - APP__ADMIN__PASSWORD=TIPAdminPassword\n      - APP__ADMIN__TOKEN=tip-opencti-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n      - REDIS__HOSTNAME=redis\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - redis\n      - rabbitmq\n      - minio\n\n  # --- TheHive ---\n  thehive:\n    image: strangebee\u002Fthehive:5.3\n    environment:\n      - TH_CORTEX_URL=http:\u002F\u002Fcortex:9001\n    ports:\n      - \"9000:9000\"\n    depends_on:\n      - elasticsearch\n\n  # --- Cortex ---\n  cortex:\n    image: thehiveproject\u002Fcortex:3.1.8\n    ports:\n      - \"9001:9001\"\n    depends_on:\n      - elasticsearch\n\nvolumes:\n  es-data:\n  misp-data:\n```\n\n### Step 2: Configure Feed Ingestion Pipeline\n\n```python\nfrom pymisp import PyMISP\nfrom pycti import OpenCTIApiClient\nimport json\n\nclass TIPFeedManager:\n    \"\"\"Manage threat intelligence feed ingestion across platform components.\"\"\"\n\n    def __init__(self, misp_url, misp_key, opencti_url, opencti_token):\n        self.misp = PyMISP(misp_url, misp_key, ssl=False)\n        self.opencti = OpenCTIApiClient(opencti_url, opencti_token)\n\n    def configure_osint_feeds(self):\n        \"\"\"Enable default OSINT feeds in MISP.\"\"\"\n        osint_feeds = [\n            {\"name\": \"CIRCL OSINT\", \"id\": 1},\n            {\"name\": \"Botvrij.eu\", \"id\": 2},\n            {\"name\": \"abuse.ch URLhaus\", \"id\": 5},\n            {\"name\": \"abuse.ch Feodo Tracker\", \"id\": 6},\n        ]\n        for feed in osint_feeds:\n            try:\n                self.misp.enable_feed(feed[\"id\"])\n                self.misp.fetch_feed(feed[\"id\"])\n                print(f\"[+] Enabled feed: {feed['name']}\")\n            except Exception as e:\n                print(f\"[-] Failed: {feed['name']}: {e}\")\n\n    def configure_opencti_connectors(self):\n        \"\"\"List and verify OpenCTI connector status.\"\"\"\n        connectors = self.opencti.connector.list()\n        for conn in connectors:\n            print(\n                f\"  Connector: {conn['name']} - \"\n                f\"Active: {conn['active']} - \"\n                f\"Type: {conn['connector_type']}\"\n            )\n\n    def sync_misp_to_opencti(self):\n        \"\"\"Verify MISP-OpenCTI sync is operational.\"\"\"\n        # OpenCTI MISP connector handles this automatically\n        # Check connector status\n        connectors = self.opencti.connector.list()\n        misp_connector = [\n            c for c in connectors if \"misp\" in c[\"name\"].lower()\n        ]\n        if misp_connector:\n            print(f\"[+] MISP connector active: {misp_connector[0]['active']}\")\n        else:\n            print(\"[-] MISP connector not found - configure in Docker Compose\")\n```\n\n### Step 3: Build Enrichment Pipeline with Cortex\n\n```python\nimport requests\n\nclass CortexEnrichment:\n    \"\"\"Integrate Cortex analyzers for automated enrichment.\"\"\"\n\n    def __init__(self, cortex_url, cortex_key):\n        self.url = cortex_url\n        self.headers = {\"Authorization\": f\"Bearer {cortex_key}\"}\n\n    def list_analyzers(self):\n        \"\"\"List available Cortex analyzers.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\",\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            analyzers = resp.json()\n            for a in analyzers:\n                print(f\"  {a['name']}: {a.get('description', '')[:60]}\")\n            return analyzers\n        return []\n\n    def analyze_observable(self, observable_type, observable_value, analyzer_id):\n        \"\"\"Submit an observable for analysis.\"\"\"\n        job = {\n            \"data\": observable_value,\n            \"dataType\": observable_type,\n            \"tlp\": 2,\n            \"message\": \"TIP automated enrichment\",\n        }\n        resp = requests.post(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\u002F{analyzer_id}\u002Frun\",\n            json=job,\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n\n    def get_job_report(self, job_id):\n        \"\"\"Get the report for a completed analysis job.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fjob\u002F{job_id}\u002Freport\",\n            headers=self.headers,\n            timeout=60,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n```\n\n### Step 4: Implement Analyst Dashboard Metrics\n\n```python\nclass TIPMetrics:\n    \"\"\"Collect platform metrics for analyst dashboards.\"\"\"\n\n    def __init__(self, misp, opencti):\n        self.misp = misp\n        self.opencti = opencti\n\n    def get_platform_stats(self):\n        \"\"\"Collect statistics across all platform components.\"\"\"\n        stats = {}\n\n        # MISP stats\n        misp_stats = self.misp.get_server_statistics()\n        stats[\"misp\"] = {\n            \"total_events\": misp_stats.get(\"event_count\", 0),\n            \"total_attributes\": misp_stats.get(\"attribute_count\", 0),\n            \"active_feeds\": len([\n                f for f in self.misp.feeds()\n                if f.get(\"Feed\", {}).get(\"enabled\")\n            ]),\n        }\n\n        # OpenCTI stats via GraphQL\n        stats[\"opencti\"] = {\n            \"total_indicators\": self.opencti.indicator.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n            \"total_reports\": self.opencti.report.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n        }\n\n        return stats\n```\n\n## Validation Criteria\n\n- All platform components (MISP, OpenCTI, TheHive, Cortex) deployed and accessible\n- MISP-OpenCTI bidirectional sync operational\n- At least 3 OSINT feeds ingesting data\n- Cortex analyzers configured and returning enrichment results\n- Platform metrics dashboard showing real-time statistics\n- STIX\u002FTAXII export functional for intelligence sharing\n\n## References\n\n- [OpenCTI Documentation](https:\u002F\u002Fdocs.opencti.io\u002F)\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [TheHive Project](https:\u002F\u002Fthehive-project.org\u002F)\n- [Cortex Documentation](https:\u002F\u002Fgithub.com\u002FTheHive-Project\u002FCortex)\n- [MISP-OpenCTI Integration](https:\u002F\u002Fdocs.opencti.io\u002Flatest\u002Fdeployment\u002Fconnectors\u002F)\n","# Building Threat Intelligence Platform\n\n## Overview\n\nBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX\u002FTAXII interoperability, and building analyst dashboards for CTI operations.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence platform capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deploying platform components\n- Python 3.9+ with `pymisp`, `pycti`, `thehive4py` libraries\n- Elasticsearch\u002FOpenSearch cluster for data storage\n- Redis and RabbitMQ for message queuing\n- Understanding of STIX 2.1 data model and TAXII 2.1 transport\n- API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)\n\n## Key Concepts\n\n### TIP Architecture Components\n1. **Collection Layer**: Feed ingestion from OSINT, commercial, and internal sources\n2. **Storage Layer**: Elasticsearch\u002FOpenSearch for indexed CTI data with STIX 2.1 schema\n3. **Analysis Layer**: OpenCTI for knowledge graph analysis and MISP for IOC correlation\n4. **Enrichment Layer**: Cortex analyzers for automated IOC enrichment\n5. **Response Layer**: TheHive for case management and incident response integration\n6. **Sharing Layer**: TAXII server for outbound intelligence sharing\n\n### Platform Integration Points\n- **MISP \u003C-> OpenCTI**: Bidirectional sync via OpenCTI MISP connector\n- **OpenCTI \u003C-> TheHive**: Alert\u002Fcase creation from high-confidence indicators\n- **TheHive \u003C-> Cortex**: Automated analysis and enrichment of case observables\n- **All \u003C-> SIEM**: Real-time IOC push to Splunk\u002FElastic via API or Kafka\n\n## Workflow\n\n### Step 1: Deploy Platform with Docker Compose\n\n```yaml\nversion: '3.8'\nservices:\n  # --- Storage Layer ---\n  elasticsearch:\n    image: docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.12.0\n    environment:\n      - discovery.type=single-node\n      - xpack.security.enabled=false\n      - \"ES_JAVA_OPTS=-Xms2g -Xmx2g\"\n    ports:\n      - \"9200:9200\"\n    volumes:\n      - es-data:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n\n  redis:\n    image: redis:7\n    ports:\n      - \"6379:6379\"\n\n  rabbitmq:\n    image: rabbitmq:3-management\n    ports:\n      - \"5672:5672\"\n      - \"15672:15672\"\n\n  minio:\n    image: minio\u002Fminio\n    command: server \u002Fdata --console-address \":9001\"\n    ports:\n      - \"9000:9000\"\n      - \"9001:9001\"\n\n  # --- MISP ---\n  misp:\n    image: ghcr.io\u002Fmisp\u002Fmisp-docker\u002Fmisp-core:latest\n    ports:\n      - \"8443:443\"\n    environment:\n      - MISP_ADMIN_EMAIL=admin@tip.local\n      - MISP_BASEURL=https:\u002F\u002Flocalhost:8443\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n\n  # --- OpenCTI ---\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@tip.local\n      - APP__ADMIN__PASSWORD=TIPAdminPassword\n      - APP__ADMIN__TOKEN=tip-opencti-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n      - REDIS__HOSTNAME=redis\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - redis\n      - rabbitmq\n      - minio\n\n  # --- TheHive ---\n  thehive:\n    image: strangebee\u002Fthehive:5.3\n    environment:\n      - TH_CORTEX_URL=http:\u002F\u002Fcortex:9001\n    ports:\n      - \"9000:9000\"\n    depends_on:\n      - elasticsearch\n\n  # --- Cortex ---\n  cortex:\n    image: thehiveproject\u002Fcortex:3.1.8\n    ports:\n      - \"9001:9001\"\n    depends_on:\n      - elasticsearch\n\nvolumes:\n  es-data:\n  misp-data:\n```\n\n### Step 2: Configure Feed Ingestion Pipeline\n\n```python\nfrom pymisp import PyMISP\nfrom pycti import OpenCTIApiClient\nimport json\n\nclass TIPFeedManager:\n    \"\"\"Manage threat intelligence feed ingestion across platform components.\"\"\"\n\n    def __init__(self, misp_url, misp_key, opencti_url, opencti_token):\n        self.misp = PyMISP(misp_url, misp_key, ssl=False)\n        self.opencti = OpenCTIApiClient(opencti_url, opencti_token)\n\n    def configure_osint_feeds(self):\n        \"\"\"Enable default OSINT feeds in MISP.\"\"\"\n        osint_feeds = [\n            {\"name\": \"CIRCL OSINT\", \"id\": 1},\n            {\"name\": \"Botvrij.eu\", \"id\": 2},\n            {\"name\": \"abuse.ch URLhaus\", \"id\": 5},\n            {\"name\": \"abuse.ch Feodo Tracker\", \"id\": 6},\n        ]\n        for feed in osint_feeds:\n            try:\n                self.misp.enable_feed(feed[\"id\"])\n                self.misp.fetch_feed(feed[\"id\"])\n                print(f\"[+] Enabled feed: {feed['name']}\")\n            except Exception as e:\n                print(f\"[-] Failed: {feed['name']}: {e}\")\n\n    def configure_opencti_connectors(self):\n        \"\"\"List and verify OpenCTI connector status.\"\"\"\n        connectors = self.opencti.connector.list()\n        for conn in connectors:\n            print(\n                f\"  Connector: {conn['name']} - \"\n                f\"Active: {conn['active']} - \"\n                f\"Type: {conn['connector_type']}\"\n            )\n\n    def sync_misp_to_opencti(self):\n        \"\"\"Verify MISP-OpenCTI sync is operational.\"\"\"\n        # OpenCTI MISP connector handles this automatically\n        # Check connector status\n        connectors = self.opencti.connector.list()\n        misp_connector = [\n            c for c in connectors if \"misp\" in c[\"name\"].lower()\n        ]\n        if misp_connector:\n            print(f\"[+] MISP connector active: {misp_connector[0]['active']}\")\n        else:\n            print(\"[-] MISP connector not found - configure in Docker Compose\")\n```\n\n### Step 3: Build Enrichment Pipeline with Cortex\n\n```python\nimport requests\n\nclass CortexEnrichment:\n    \"\"\"Integrate Cortex analyzers for automated enrichment.\"\"\"\n\n    def __init__(self, cortex_url, cortex_key):\n        self.url = cortex_url\n        self.headers = {\"Authorization\": f\"Bearer {cortex_key}\"}\n\n    def list_analyzers(self):\n        \"\"\"List available Cortex analyzers.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\",\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            analyzers = resp.json()\n            for a in analyzers:\n                print(f\"  {a['name']}: {a.get('description', '')[:60]}\")\n            return analyzers\n        return []\n\n    def analyze_observable(self, observable_type, observable_value, analyzer_id):\n        \"\"\"Submit an observable for analysis.\"\"\"\n        job = {\n            \"data\": observable_value,\n            \"dataType\": observable_type,\n            \"tlp\": 2,\n            \"message\": \"TIP automated enrichment\",\n        }\n        resp = requests.post(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\u002F{analyzer_id}\u002Frun\",\n            json=job,\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n\n    def get_job_report(self, job_id):\n        \"\"\"Get the report for a completed analysis job.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fjob\u002F{job_id}\u002Freport\",\n            headers=self.headers,\n            timeout=60,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n```\n\n### Step 4: Implement Analyst Dashboard Metrics\n\n```python\nclass TIPMetrics:\n    \"\"\"Collect platform metrics for analyst dashboards.\"\"\"\n\n    def __init__(self, misp, opencti):\n        self.misp = misp\n        self.opencti = opencti\n\n    def get_platform_stats(self):\n        \"\"\"Collect statistics across all platform components.\"\"\"\n        stats = {}\n\n        # MISP stats\n        misp_stats = self.misp.get_server_statistics()\n        stats[\"misp\"] = {\n            \"total_events\": misp_stats.get(\"event_count\", 0),\n            \"total_attributes\": misp_stats.get(\"attribute_count\", 0),\n            \"active_feeds\": len([\n                f for f in self.misp.feeds()\n                if f.get(\"Feed\", {}).get(\"enabled\")\n            ]),\n        }\n\n        # OpenCTI stats via GraphQL\n        stats[\"opencti\"] = {\n            \"total_indicators\": self.opencti.indicator.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n            \"total_reports\": self.opencti.report.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n        }\n\n        return stats\n```\n\n## Validation Criteria\n\n- All platform components (MISP, OpenCTI, TheHive, Cortex) deployed and accessible\n- MISP-OpenCTI bidirectional sync operational\n- At least 3 OSINT feeds ingesting data\n- Cortex analyzers configured and returning enrichment results\n- Platform metrics dashboard showing real-time statistics\n- STIX\u002FTAXII export functional for intelligence sharing\n\n## References\n\n- [OpenCTI Documentation](https:\u002F\u002Fdocs.opencti.io\u002F)\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [TheHive Project](https:\u002F\u002Fthehive-project.org\u002F)\n- [Cortex Documentation](https:\u002F\u002Fgithub.com\u002FTheHive-Project\u002FCortex)\n- [MISP-OpenCTI Integration](https:\u002F\u002Fdocs.opencti.io\u002Flatest\u002Fdeployment\u002Fconnectors\u002F)\n",{"name":5,"tags":47,"author":49,"domain":41,"license":15,"version":50,"subdomain":39,"description":7},[39,35,29,40,30,34,48,33],"misp","mahipal","1.0","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform",1,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-threat-intelligence-platform",{"tool":65,"command":66},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-threat-intelligence-platform",{"tool":68,"command":69},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-threat-intelligence-platform","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002FSKILL.md",true,[73,79,84,90,94,98,104],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"assets\u002Ftemplate.md","ASSET","资产文件",987,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002Fassets\u002Ftemplate.md",{"path":80,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002FLICENSE",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fapi-reference.md","REFERENCE","参考文档",1930,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002Freferences\u002Fapi-reference.md",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fstandards.md",1183,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002Freferences\u002Fstandards.md",{"path":95,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fworkflows.md",1486,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002Freferences\u002Fworkflows.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",5791,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002Fscripts\u002Fagent.py",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fprocess.py",6322,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-threat-intelligence-platform\u002Fscripts\u002Fprocess.py",[109,137,154,182,215,252],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":42},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":42},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[144,145,146,147,148,149,150,151,152,153],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":163,"publishedAt":42},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[160],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[164,165,166,167,168,169,170,171,145,172,173,174,117,175,176,177,178,179,180,181],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":194,"publishedAt":42},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[188,191],{"categoryNo":189,"categoryName":190,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":233,"publishedAt":42},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[221,224,227,228],{"categoryNo":222,"categoryName":223,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":229,"categoryName":230,"taxonomyType":231,"taxonomyTypeDesc":232},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":258,"publishedAt":42},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[173,259,260,261,262,263,264,123,265,266,267,268,269,208,270,271,214,272],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]