[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HCKVZF22MDFRZ4T873H38C":3,"skill-same:01M6HCKVZF22MDFRZ4T873H38C":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6HCKVZF22MDFRZ4T873H38C","building-threat-intelligence-platform",null,"Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"threat intelligence","platform","intelligence","threat","building threat intelligence platform","ioc","stix","MISP","analyzing","platform-building","cti","TIP","system","threat-intelligence","cm","mitre-attack","cybersecurity","id","de","for","2026-11-10 10:12:30",false,"---\nname: building-threat-intelligence-platform\ndescription: Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- platform-building\n- misp\n- opencti\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1071\n- T1588.001\n- T1591\ncategory: building-threat-intelligence-platform\n---\n# Building Threat Intelligence Platform\n\n## Overview\n\nBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX\u002FTAXII interoperability, and building analyst dashboards for CTI operations.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence platform capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deploying platform components\n- Python 3.9+ with `pymisp`, `pycti`, `thehive4py` libraries\n- Elasticsearch\u002FOpenSearch cluster for data storage\n- Redis and RabbitMQ for message queuing\n- Understanding of STIX 2.1 data model and TAXII 2.1 transport\n- API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)\n\n## Key Concepts\n\n### TIP Architecture Components\n1. **Collection Layer**: Feed ingestion from OSINT, commercial, and internal sources\n2. **Storage Layer**: Elasticsearch\u002FOpenSearch for indexed CTI data with STIX 2.1 schema\n3. **Analysis Layer**: OpenCTI for knowledge graph analysis and MISP for IOC correlation\n4. **Enrichment Layer**: Cortex analyzers for automated IOC enrichment\n5. **Response Layer**: TheHive for case management and incident response integration\n6. **Sharing Layer**: TAXII server for outbound intelligence sharing\n\n### Platform Integration Points\n- **MISP \u003C-> OpenCTI**: Bidirectional sync via OpenCTI MISP connector\n- **OpenCTI \u003C-> TheHive**: Alert\u002Fcase creation from high-confidence indicators\n- **TheHive \u003C-> Cortex**: Automated analysis and enrichment of case observables\n- **All \u003C-> SIEM**: Real-time IOC push to Splunk\u002FElastic via API or Kafka\n\n## Workflow\n\n### Step 1: Deploy Platform with Docker Compose\n\n```yaml\nversion: '3.8'\nservices:\n  # --- Storage Layer ---\n  elasticsearch:\n    image: docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.12.0\n    environment:\n      - discovery.type=single-node\n      - xpack.security.enabled=false\n      - \"ES_JAVA_OPTS=-Xms2g -Xmx2g\"\n    ports:\n      - \"9200:9200\"\n    volumes:\n      - es-data:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n\n  redis:\n    image: redis:7\n    ports:\n      - \"6379:6379\"\n\n  rabbitmq:\n    image: rabbitmq:3-management\n    ports:\n      - \"5672:5672\"\n      - \"15672:15672\"\n\n  minio:\n    image: minio\u002Fminio\n    command: server \u002Fdata --console-address \":9001\"\n    ports:\n      - \"9000:9000\"\n      - \"9001:9001\"\n\n  # --- MISP ---\n  misp:\n    image: ghcr.io\u002Fmisp\u002Fmisp-docker\u002Fmisp-core:latest\n    ports:\n      - \"8443:443\"\n    environment:\n      - MISP_ADMIN_EMAIL=admin@tip.local\n      - MISP_BASEURL=https:\u002F\u002Flocalhost:8443\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n\n  # --- OpenCTI ---\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@tip.local\n      - APP__ADMIN__PASSWORD=TIPAdminPassword\n      - APP__ADMIN__TOKEN=tip-opencti-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n      - REDIS__HOSTNAME=redis\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - redis\n      - rabbitmq\n      - minio\n\n  # --- TheHive ---\n  thehive:\n    image: strangebee\u002Fthehive:5.3\n    environment:\n      - TH_CORTEX_URL=http:\u002F\u002Fcortex:9001\n    ports:\n      - \"9000:9000\"\n    depends_on:\n      - elasticsearch\n\n  # --- Cortex ---\n  cortex:\n    image: thehiveproject\u002Fcortex:3.1.8\n    ports:\n      - \"9001:9001\"\n    depends_on:\n      - elasticsearch\n\nvolumes:\n  es-data:\n  misp-data:\n```\n\n### Step 2: Configure Feed Ingestion Pipeline\n\n```python\nfrom pymisp import PyMISP\nfrom pycti import OpenCTIApiClient\nimport json\n\nclass TIPFeedManager:\n    \"\"\"Manage threat intelligence feed ingestion across platform components.\"\"\"\n\n    def __init__(self, misp_url, misp_key, opencti_url, opencti_token):\n        self.misp = PyMISP(misp_url, misp_key, ssl=False)\n        self.opencti = OpenCTIApiClient(opencti_url, opencti_token)\n\n    def configure_osint_feeds(self):\n        \"\"\"Enable default OSINT feeds in MISP.\"\"\"\n        osint_feeds = [\n            {\"name\": \"CIRCL OSINT\", \"id\": 1},\n            {\"name\": \"Botvrij.eu\", \"id\": 2},\n            {\"name\": \"abuse.ch URLhaus\", \"id\": 5},\n            {\"name\": \"abuse.ch Feodo Tracker\", \"id\": 6},\n        ]\n        for feed in osint_feeds:\n            try:\n                self.misp.enable_feed(feed[\"id\"])\n                self.misp.fetch_feed(feed[\"id\"])\n                print(f\"[+] Enabled feed: {feed['name']}\")\n            except Exception as e:\n                print(f\"[-] Failed: {feed['name']}: {e}\")\n\n    def configure_opencti_connectors(self):\n        \"\"\"List and verify OpenCTI connector status.\"\"\"\n        connectors = self.opencti.connector.list()\n        for conn in connectors:\n            print(\n                f\"  Connector: {conn['name']} - \"\n                f\"Active: {conn['active']} - \"\n                f\"Type: {conn['connector_type']}\"\n            )\n\n    def sync_misp_to_opencti(self):\n        \"\"\"Verify MISP-OpenCTI sync is operational.\"\"\"\n        # OpenCTI MISP connector handles this automatically\n        # Check connector status\n        connectors = self.opencti.connector.list()\n        misp_connector = [\n            c for c in connectors if \"misp\" in c[\"name\"].lower()\n        ]\n        if misp_connector:\n            print(f\"[+] MISP connector active: {misp_connector[0]['active']}\")\n        else:\n            print(\"[-] MISP connector not found - configure in Docker Compose\")\n```\n\n### Step 3: Build Enrichment Pipeline with Cortex\n\n```python\nimport requests\n\nclass CortexEnrichment:\n    \"\"\"Integrate Cortex analyzers for automated enrichment.\"\"\"\n\n    def __init__(self, cortex_url, cortex_key):\n        self.url = cortex_url\n        self.headers = {\"Authorization\": f\"Bearer {cortex_key}\"}\n\n    def list_analyzers(self):\n        \"\"\"List available Cortex analyzers.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\",\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            analyzers = resp.json()\n            for a in analyzers:\n                print(f\"  {a['name']}: {a.get('description', '')[:60]}\")\n            return analyzers\n        return []\n\n    def analyze_observable(self, observable_type, observable_value, analyzer_id):\n        \"\"\"Submit an observable for analysis.\"\"\"\n        job = {\n            \"data\": observable_value,\n            \"dataType\": observable_type,\n            \"tlp\": 2,\n            \"message\": \"TIP automated enrichment\",\n        }\n        resp = requests.post(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\u002F{analyzer_id}\u002Frun\",\n            json=job,\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n\n    def get_job_report(self, job_id):\n        \"\"\"Get the report for a completed analysis job.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fjob\u002F{job_id}\u002Freport\",\n            headers=self.headers,\n            timeout=60,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n```\n\n### Step 4: Implement Analyst Dashboard Metrics\n\n```python\nclass TIPMetrics:\n    \"\"\"Collect platform metrics for analyst dashboards.\"\"\"\n\n    def __init__(self, misp, opencti):\n        self.misp = misp\n        self.opencti = opencti\n\n    def get_platform_stats(self):\n        \"\"\"Collect statistics across all platform components.\"\"\"\n        stats = {}\n\n        # MISP stats\n        misp_stats = self.misp.get_server_statistics()\n        stats[\"misp\"] = {\n            \"total_events\": misp_stats.get(\"event_count\", 0),\n            \"total_attributes\": misp_stats.get(\"attribute_count\", 0),\n            \"active_feeds\": len([\n                f for f in self.misp.feeds()\n                if f.get(\"Feed\", {}).get(\"enabled\")\n            ]),\n        }\n\n        # OpenCTI stats via GraphQL\n        stats[\"opencti\"] = {\n            \"total_indicators\": self.opencti.indicator.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n            \"total_reports\": self.opencti.report.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n        }\n\n        return stats\n```\n\n## Validation Criteria\n\n- All platform components (MISP, OpenCTI, TheHive, Cortex) deployed and accessible\n- MISP-OpenCTI bidirectional sync operational\n- At least 3 OSINT feeds ingesting data\n- Cortex analyzers configured and returning enrichment results\n- Platform metrics dashboard showing real-time statistics\n- STIX\u002FTAXII export functional for intelligence sharing\n\n## References\n\n- [OpenCTI Documentation](https:\u002F\u002Fdocs.opencti.io\u002F)\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [TheHive Project](https:\u002F\u002Fthehive-project.org\u002F)\n- [Cortex Documentation](https:\u002F\u002Fgithub.com\u002FTheHive-Project\u002FCortex)\n- [MISP-OpenCTI Integration](https:\u002F\u002Fdocs.opencti.io\u002Flatest\u002Fdeployment\u002Fconnectors\u002F)\n","# Building Threat Intelligence Platform\n\n## Overview\n\nBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX\u002FTAXII interoperability, and building analyst dashboards for CTI operations.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence platform capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deploying platform components\n- Python 3.9+ with `pymisp`, `pycti`, `thehive4py` libraries\n- Elasticsearch\u002FOpenSearch cluster for data storage\n- Redis and RabbitMQ for message queuing\n- Understanding of STIX 2.1 data model and TAXII 2.1 transport\n- API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)\n\n## Key Concepts\n\n### TIP Architecture Components\n1. **Collection Layer**: Feed ingestion from OSINT, commercial, and internal sources\n2. **Storage Layer**: Elasticsearch\u002FOpenSearch for indexed CTI data with STIX 2.1 schema\n3. **Analysis Layer**: OpenCTI for knowledge graph analysis and MISP for IOC correlation\n4. **Enrichment Layer**: Cortex analyzers for automated IOC enrichment\n5. **Response Layer**: TheHive for case management and incident response integration\n6. **Sharing Layer**: TAXII server for outbound intelligence sharing\n\n### Platform Integration Points\n- **MISP \u003C-> OpenCTI**: Bidirectional sync via OpenCTI MISP connector\n- **OpenCTI \u003C-> TheHive**: Alert\u002Fcase creation from high-confidence indicators\n- **TheHive \u003C-> Cortex**: Automated analysis and enrichment of case observables\n- **All \u003C-> SIEM**: Real-time IOC push to Splunk\u002FElastic via API or Kafka\n\n## Workflow\n\n### Step 1: Deploy Platform with Docker Compose\n\n```yaml\nversion: '3.8'\nservices:\n  # --- Storage Layer ---\n  elasticsearch:\n    image: docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.12.0\n    environment:\n      - discovery.type=single-node\n      - xpack.security.enabled=false\n      - \"ES_JAVA_OPTS=-Xms2g -Xmx2g\"\n    ports:\n      - \"9200:9200\"\n    volumes:\n      - es-data:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n\n  redis:\n    image: redis:7\n    ports:\n      - \"6379:6379\"\n\n  rabbitmq:\n    image: rabbitmq:3-management\n    ports:\n      - \"5672:5672\"\n      - \"15672:15672\"\n\n  minio:\n    image: minio\u002Fminio\n    command: server \u002Fdata --console-address \":9001\"\n    ports:\n      - \"9000:9000\"\n      - \"9001:9001\"\n\n  # --- MISP ---\n  misp:\n    image: ghcr.io\u002Fmisp\u002Fmisp-docker\u002Fmisp-core:latest\n    ports:\n      - \"8443:443\"\n    environment:\n      - MISP_ADMIN_EMAIL=admin@tip.local\n      - MISP_BASEURL=https:\u002F\u002Flocalhost:8443\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n\n  # --- OpenCTI ---\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@tip.local\n      - APP__ADMIN__PASSWORD=TIPAdminPassword\n      - APP__ADMIN__TOKEN=tip-opencti-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n      - REDIS__HOSTNAME=redis\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - redis\n      - rabbitmq\n      - minio\n\n  # --- TheHive ---\n  thehive:\n    image: strangebee\u002Fthehive:5.3\n    environment:\n      - TH_CORTEX_URL=http:\u002F\u002Fcortex:9001\n    ports:\n      - \"9000:9000\"\n    depends_on:\n      - elasticsearch\n\n  # --- Cortex ---\n  cortex:\n    image: thehiveproject\u002Fcortex:3.1.8\n    ports:\n      - \"9001:9001\"\n    depends_on:\n      - elasticsearch\n\nvolumes:\n  es-data:\n  misp-data:\n```\n\n### Step 2: Configure Feed Ingestion Pipeline\n\n```python\nfrom pymisp import PyMISP\nfrom pycti import OpenCTIApiClient\nimport json\n\nclass TIPFeedManager:\n    \"\"\"Manage threat intelligence feed ingestion across platform components.\"\"\"\n\n    def __init__(self, misp_url, misp_key, opencti_url, opencti_token):\n        self.misp = PyMISP(misp_url, misp_key, ssl=False)\n        self.opencti = OpenCTIApiClient(opencti_url, opencti_token)\n\n    def configure_osint_feeds(self):\n        \"\"\"Enable default OSINT feeds in MISP.\"\"\"\n        osint_feeds = [\n            {\"name\": \"CIRCL OSINT\", \"id\": 1},\n            {\"name\": \"Botvrij.eu\", \"id\": 2},\n            {\"name\": \"abuse.ch URLhaus\", \"id\": 5},\n            {\"name\": \"abuse.ch Feodo Tracker\", \"id\": 6},\n        ]\n        for feed in osint_feeds:\n            try:\n                self.misp.enable_feed(feed[\"id\"])\n                self.misp.fetch_feed(feed[\"id\"])\n                print(f\"[+] Enabled feed: {feed['name']}\")\n            except Exception as e:\n                print(f\"[-] Failed: {feed['name']}: {e}\")\n\n    def configure_opencti_connectors(self):\n        \"\"\"List and verify OpenCTI connector status.\"\"\"\n        connectors = self.opencti.connector.list()\n        for conn in connectors:\n            print(\n                f\"  Connector: {conn['name']} - \"\n                f\"Active: {conn['active']} - \"\n                f\"Type: {conn['connector_type']}\"\n            )\n\n    def sync_misp_to_opencti(self):\n        \"\"\"Verify MISP-OpenCTI sync is operational.\"\"\"\n        # OpenCTI MISP connector handles this automatically\n        # Check connector status\n        connectors = self.opencti.connector.list()\n        misp_connector = [\n            c for c in connectors if \"misp\" in c[\"name\"].lower()\n        ]\n        if misp_connector:\n            print(f\"[+] MISP connector active: {misp_connector[0]['active']}\")\n        else:\n            print(\"[-] MISP connector not found - configure in Docker Compose\")\n```\n\n### Step 3: Build Enrichment Pipeline with Cortex\n\n```python\nimport requests\n\nclass CortexEnrichment:\n    \"\"\"Integrate Cortex analyzers for automated enrichment.\"\"\"\n\n    def __init__(self, cortex_url, cortex_key):\n        self.url = cortex_url\n        self.headers = {\"Authorization\": f\"Bearer {cortex_key}\"}\n\n    def list_analyzers(self):\n        \"\"\"List available Cortex analyzers.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\",\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            analyzers = resp.json()\n            for a in analyzers:\n                print(f\"  {a['name']}: {a.get('description', '')[:60]}\")\n            return analyzers\n        return []\n\n    def analyze_observable(self, observable_type, observable_value, analyzer_id):\n        \"\"\"Submit an observable for analysis.\"\"\"\n        job = {\n            \"data\": observable_value,\n            \"dataType\": observable_type,\n            \"tlp\": 2,\n            \"message\": \"TIP automated enrichment\",\n        }\n        resp = requests.post(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\u002F{analyzer_id}\u002Frun\",\n            json=job,\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n\n    def get_job_report(self, job_id):\n        \"\"\"Get the report for a completed analysis job.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fjob\u002F{job_id}\u002Freport\",\n            headers=self.headers,\n            timeout=60,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n```\n\n### Step 4: Implement Analyst Dashboard Metrics\n\n```python\nclass TIPMetrics:\n    \"\"\"Collect platform metrics for analyst dashboards.\"\"\"\n\n    def __init__(self, misp, opencti):\n        self.misp = misp\n        self.opencti = opencti\n\n    def get_platform_stats(self):\n        \"\"\"Collect statistics across all platform components.\"\"\"\n        stats = {}\n\n        # MISP stats\n        misp_stats = self.misp.get_server_statistics()\n        stats[\"misp\"] = {\n            \"total_events\": misp_stats.get(\"event_count\", 0),\n            \"total_attributes\": misp_stats.get(\"attribute_count\", 0),\n            \"active_feeds\": len([\n                f for f in self.misp.feeds()\n                if f.get(\"Feed\", {}).get(\"enabled\")\n            ]),\n        }\n\n        # OpenCTI stats via GraphQL\n        stats[\"opencti\"] = {\n            \"total_indicators\": self.opencti.indicator.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n            \"total_reports\": self.opencti.report.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n        }\n\n        return stats\n```\n\n## Validation Criteria\n\n- All platform components (MISP, OpenCTI, TheHive, Cortex) deployed and accessible\n- MISP-OpenCTI bidirectional sync operational\n- At least 3 OSINT feeds ingesting data\n- Cortex analyzers configured and returning enrichment results\n- Platform metrics dashboard showing real-time statistics\n- STIX\u002FTAXII export functional for intelligence sharing\n\n## References\n\n- [OpenCTI Documentation](https:\u002F\u002Fdocs.opencti.io\u002F)\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [TheHive Project](https:\u002F\u002Fthehive-project.org\u002F)\n- [Cortex Documentation](https:\u002F\u002Fgithub.com\u002FTheHive-Project\u002FCortex)\n- [MISP-OpenCTI Integration](https:\u002F\u002Fdocs.opencti.io\u002Flatest\u002Fdeployment\u002Fconnectors\u002F)\n",{"name":5,"tags":49,"author":52,"domain":40,"license":15,"version":53,"category":5,"nist_csf":54,"subdomain":37,"description":7,"mitre_attack":59},[37,34,29,39,30,33,50,51],"misp","opencti","mahipal","1.0",[55,56,57,58],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[60,61,62],"T1071","T1588.001","T1591","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fbuilding-threat-intelligence-platform",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill building-threat-intelligence-platform",{"tool":77,"command":78},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill building-threat-intelligence-platform",{"tool":80,"command":81},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill building-threat-intelligence-platform","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002FSKILL.md",true,[85,91,96,102,106,110,116],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",987,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1930,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",1183,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",1486,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",5791,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002Fscripts\u002Fagent.py",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",6322,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-threat-intelligence-platform\u002Fscripts\u002Fprocess.py",[121,149,175,198,214,233],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":130,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[131,132,133,134,43,135,40,136,137,138,139,140,141,142,143,144,145,146,147,148],"integrity","backup","recovery","validating backup integrity for recovery","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[156,157,158,159,160,40,161,162,163,164,165,166,167,168,169,170,171,172,173,174],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[182,183,146,40,184,185,186,142,143,187,188,189,190,191,192,193,194,195,196,197],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[182,205,206,183,146,160,40,207,185,139,208,209,142,143,210,188,170,211,212,213],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[182,221,222,223,224,225,40,226,227,228,185,229,142,230,231,232,191,38,146,42],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":239,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[240,241,242,27,40,243,39,244,37,245,246,230,247,248,38,26,42,249,250,251],"infrastructure","tracking threat actor infrastructure","tracking","monitoring","threat-actor","command-and-control","dns","command","exploit","domains","kit","hosts"]