[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HF01ZEXSTRC7EKDFXKAZD9":3,"skill-same:01M6HF01ZEXSTRC7EKDFXKAZD9":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6HF01ZEXSTRC7EKDFXKAZD9","evaluating-threat-intelligence-platforms",null,"Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX\u002FTAXII support, workflow automation, analyst interface, and total cost of ownership. Use when...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fevaluating-threat-intelligence-platforms\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"threat intelligence","intelligence","threat","evaluating threat intelligence platforms","interface","cybersecurity","de","analyst","cm","team","procurement","CTI-program","EclecticIQ","Anomali","TIP","STIX-TAXII","threat-intelligence","Workflow Automation","support","workflow","2026-11-10 10:12:30",false,"---\nname: evaluating-threat-intelligence-platforms\ndescription: Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX\u002FTAXII support, workflow automation, analyst interface, and total cost of ownership. Use when...\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- TIP\n- ThreatConnect\n- MISP\n- OpenCTI\n- Anomali\n- EclecticIQ\n- STIX-TAXII\n- CTI-program\n- procurement\nversion: 1.0.0\nauthor: team-cybersecurity\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\ncategory: evaluating-threat-intelligence-platforms\n---\n# Evaluating-Threat-Intelligence-Platforms\n\n## Overview\nEvaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX\u002FTAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.\n\n\n# Evaluating Threat Intelligence Platforms\n\n## When to Use\n\nUse this skill when:\n- Conducting a formal RFP or vendor evaluation for a TIP solution\n- Assessing whether the current TIP (e.g., MISP) needs to be replaced or augmented as the CTI program scales\n- Establishing evaluation criteria aligned to organizational maturity and budget\n\n**Do not use** this skill for evaluating feed quality independently of the TIP — feed evaluation is a separate workflow focused on data quality rather than platform capabilities.\n\n## Prerequisites\n\n- Documented CTI program requirements: team size, feed sources, integration targets, use cases\n- Budget range and procurement timeline\n- Technical staff who will administer the platform (Python\u002FAPI experience for open-source TIPs)\n- List of current and planned integrations (SIEM, SOAR, EDR, firewalls)\n\n## Workflow\n\n### Step 1: Define Evaluation Criteria\n\nStructure requirements into mandatory (M) and desired (D) categories:\n\n**Core TIP Functions**:\n- M: STIX 2.1 import\u002Fexport with TAXII 2.1 server\n- M: REST API for automated IOC ingestion and export\n- M: Indicator deduplication and TTL management\n- M: TLP classification enforcement\n- D: Built-in MITRE ATT&CK integration and technique tagging\n- D: Graph visualization of indicator relationships\n- D: Workflow automation for analyst triage\n\n**Integrations**:\n- M: SIEM integration (Splunk, Sentinel, QRadar) via syslog, API, or native connector\n- M: EDR integration for IOC push (CrowdStrike, Defender, SentinelOne)\n- D: SOAR integration (XSOAR, Splunk SOAR) for playbook triggers\n- D: Ticketing system (ServiceNow, Jira) for intelligence task tracking\n\n**Operational**:\n- M: Role-based access control with TLP-aware data segregation\n- M: Audit logging for all analyst actions\n- D: Multi-tenancy for MSSP use cases\n\n### Step 2: Evaluate Major TIP Options\n\n**MISP (Open Source)**:\n- Cost: Free (self-hosted infrastructure cost only)\n- Strengths: Largest community, 250+ modules, extensive ISAC usage, STIX 2.0 native\n- Weaknesses: Requires dedicated admin, limited visualization, UI dated\n- Best for: Budget-constrained teams with technical staff; government\u002FISAC sharing programs\n\n**OpenCTI (Open Source)**:\n- Cost: Free (self-hosted); paid SaaS at ~$3,000–$15,000\u002Fyear\n- Strengths: Native STIX 2.1, graph visualization, ATT&CK integration, modern API\n- Weaknesses: Resource-intensive deployment (Elasticsearch, MinIO required)\n- Best for: Teams wanting open source with modern UX; SOC\u002FCTI integration focus\n\n**ThreatConnect (Commercial)**:\n- Cost: $50,000–$500,000\u002Fyear depending on scale\n- Strengths: End-to-end CTI lifecycle, playbook automation, TC Exchange marketplace, analyst workflow\n- Weaknesses: High cost; complex implementation; best value at larger scale\n- Best for: Mature enterprise CTI programs; MSSPs; red team\u002Fblue team integration\n\n**Anomali ThreatStream (Commercial)**:\n- Cost: $30,000–$200,000\u002Fyear\n- Strengths: Strong feed aggregation, Splunk-native integration, extensive pre-built connectors\n- Weaknesses: Graph visualization weaker than OpenCTI; UI refresh lagging\n- Best for: Splunk-heavy environments; teams prioritizing feed volume over analysis workflows\n\n**EclecticIQ Platform (Commercial)**:\n- Cost: $40,000–$300,000\u002Fyear\n- Strengths: STIX 2.1 native, collaborative intelligence workbench, strong European customer base\n- Weaknesses: Smaller partner ecosystem than ThreatConnect\n- Best for: Teams with MITRE ATT&CK-centric workflows; EMEA-focused organizations\n\n### Step 3: Conduct Proof of Concept\n\nRequest 30-day PoC from finalists. Test:\n1. Feed onboarding: Can your top 5 feeds be ingested within 4 hours?\n2. SIEM integration: Can enriched IOCs push to your SIEM in \u003C5 minutes?\n3. ATT&CK mapping: Can analysts tag indicators with ATT&CK techniques efficiently?\n4. Report generation: Can the platform produce a tactical IOC bulletin with one click?\n5. API performance: Can the REST API handle 10,000 indicator queries per day?\n\n### Step 4: Score and Select\n\nUse weighted scoring matrix (weight each criterion by organizational priority):\n```\nCriterion                 Weight   Vendor A   Vendor B\nSTIX 2.1 compliance       20%      95         85\nSIEM integration          25%      90         70\nATT&CK mapping            15%      85         95\nCost (inverse)            20%      60         90\nUI\u002Fanalyst experience     10%      80         75\nVendor support quality    10%      85         80\nTOTAL                     100%     82.0       81.5\n```\n\n### Step 5: Implementation and Onboarding Planning\n\nPlan 90-day implementation:\n- Week 1–2: Infrastructure deployment (cloud or on-prem)\n- Week 3–4: Feed onboarding and deduplication tuning\n- Week 5–6: SIEM\u002FSOAR integration and testing\n- Week 7–8: Analyst workflow configuration and training\n- Week 9–12: Operational validation and go-live\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TIP** | Threat Intelligence Platform — software for collecting, processing, analyzing, and disseminating cyber threat intelligence |\n| **TAXII Server** | Component of a TIP that serves STIX bundles to consuming systems on request |\n| **TC Exchange** | ThreatConnect's commercial marketplace for pre-built feed integrations and app connectors |\n| **Multi-tenancy** | TIP capability to serve multiple organizational units or customers with isolated data environments |\n| **Deduplication** | Process of identifying and merging duplicate indicators within a TIP to reduce analyst noise |\n\n## Tools & Systems\n\n- **MISP**: Open-source TIP used by 6,000+ organizations; strongest ISAC\u002Fgovernment community integration\n- **OpenCTI**: Modern open-source TIP with native STIX 2.1 and graph-based analysis\n- **ThreatConnect**: Enterprise commercial TIP with lifecycle management and SOAR playbook integration\n- **Anomali ThreatStream**: Commercial TIP with strong Splunk ecosystem integration\n- **EclecticIQ**: Commercial TIP with ATT&CK-centric workflow design\n\n## Common Pitfalls\n\n- **Selecting TIP before defining requirements**: Technology selection before use case definition leads to expensive mismatches.\n- **Underestimating administration burden**: MISP and OpenCTI require dedicated admin time (minimum 0.25 FTE); budget accordingly.\n- **Ignoring data migration costs**: Moving historical intelligence from one TIP to another is costly and often impractical for legacy systems.\n- **Not testing SIEM integration in PoC**: TIP value depends heavily on downstream integration quality; always test SIEM\u002FSOAR connectivity during evaluation.\n","# Evaluating-Threat-Intelligence-Platforms\n\n## Overview\nEvaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX\u002FTAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.\n\n\n# Evaluating Threat Intelligence Platforms\n\n## When to Use\n\nUse this skill when:\n- Conducting a formal RFP or vendor evaluation for a TIP solution\n- Assessing whether the current TIP (e.g., MISP) needs to be replaced or augmented as the CTI program scales\n- Establishing evaluation criteria aligned to organizational maturity and budget\n\n**Do not use** this skill for evaluating feed quality independently of the TIP — feed evaluation is a separate workflow focused on data quality rather than platform capabilities.\n\n## Prerequisites\n\n- Documented CTI program requirements: team size, feed sources, integration targets, use cases\n- Budget range and procurement timeline\n- Technical staff who will administer the platform (Python\u002FAPI experience for open-source TIPs)\n- List of current and planned integrations (SIEM, SOAR, EDR, firewalls)\n\n## Workflow\n\n### Step 1: Define Evaluation Criteria\n\nStructure requirements into mandatory (M) and desired (D) categories:\n\n**Core TIP Functions**:\n- M: STIX 2.1 import\u002Fexport with TAXII 2.1 server\n- M: REST API for automated IOC ingestion and export\n- M: Indicator deduplication and TTL management\n- M: TLP classification enforcement\n- D: Built-in MITRE ATT&CK integration and technique tagging\n- D: Graph visualization of indicator relationships\n- D: Workflow automation for analyst triage\n\n**Integrations**:\n- M: SIEM integration (Splunk, Sentinel, QRadar) via syslog, API, or native connector\n- M: EDR integration for IOC push (CrowdStrike, Defender, SentinelOne)\n- D: SOAR integration (XSOAR, Splunk SOAR) for playbook triggers\n- D: Ticketing system (ServiceNow, Jira) for intelligence task tracking\n\n**Operational**:\n- M: Role-based access control with TLP-aware data segregation\n- M: Audit logging for all analyst actions\n- D: Multi-tenancy for MSSP use cases\n\n### Step 2: Evaluate Major TIP Options\n\n**MISP (Open Source)**:\n- Cost: Free (self-hosted infrastructure cost only)\n- Strengths: Largest community, 250+ modules, extensive ISAC usage, STIX 2.0 native\n- Weaknesses: Requires dedicated admin, limited visualization, UI dated\n- Best for: Budget-constrained teams with technical staff; government\u002FISAC sharing programs\n\n**OpenCTI (Open Source)**:\n- Cost: Free (self-hosted); paid SaaS at ~$3,000–$15,000\u002Fyear\n- Strengths: Native STIX 2.1, graph visualization, ATT&CK integration, modern API\n- Weaknesses: Resource-intensive deployment (Elasticsearch, MinIO required)\n- Best for: Teams wanting open source with modern UX; SOC\u002FCTI integration focus\n\n**ThreatConnect (Commercial)**:\n- Cost: $50,000–$500,000\u002Fyear depending on scale\n- Strengths: End-to-end CTI lifecycle, playbook automation, TC Exchange marketplace, analyst workflow\n- Weaknesses: High cost; complex implementation; best value at larger scale\n- Best for: Mature enterprise CTI programs; MSSPs; red team\u002Fblue team integration\n\n**Anomali ThreatStream (Commercial)**:\n- Cost: $30,000–$200,000\u002Fyear\n- Strengths: Strong feed aggregation, Splunk-native integration, extensive pre-built connectors\n- Weaknesses: Graph visualization weaker than OpenCTI; UI refresh lagging\n- Best for: Splunk-heavy environments; teams prioritizing feed volume over analysis workflows\n\n**EclecticIQ Platform (Commercial)**:\n- Cost: $40,000–$300,000\u002Fyear\n- Strengths: STIX 2.1 native, collaborative intelligence workbench, strong European customer base\n- Weaknesses: Smaller partner ecosystem than ThreatConnect\n- Best for: Teams with MITRE ATT&CK-centric workflows; EMEA-focused organizations\n\n### Step 3: Conduct Proof of Concept\n\nRequest 30-day PoC from finalists. Test:\n1. Feed onboarding: Can your top 5 feeds be ingested within 4 hours?\n2. SIEM integration: Can enriched IOCs push to your SIEM in \u003C5 minutes?\n3. ATT&CK mapping: Can analysts tag indicators with ATT&CK techniques efficiently?\n4. Report generation: Can the platform produce a tactical IOC bulletin with one click?\n5. API performance: Can the REST API handle 10,000 indicator queries per day?\n\n### Step 4: Score and Select\n\nUse weighted scoring matrix (weight each criterion by organizational priority):\n```\nCriterion                 Weight   Vendor A   Vendor B\nSTIX 2.1 compliance       20%      95         85\nSIEM integration          25%      90         70\nATT&CK mapping            15%      85         95\nCost (inverse)            20%      60         90\nUI\u002Fanalyst experience     10%      80         75\nVendor support quality    10%      85         80\nTOTAL                     100%     82.0       81.5\n```\n\n### Step 5: Implementation and Onboarding Planning\n\nPlan 90-day implementation:\n- Week 1–2: Infrastructure deployment (cloud or on-prem)\n- Week 3–4: Feed onboarding and deduplication tuning\n- Week 5–6: SIEM\u002FSOAR integration and testing\n- Week 7–8: Analyst workflow configuration and training\n- Week 9–12: Operational validation and go-live\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TIP** | Threat Intelligence Platform — software for collecting, processing, analyzing, and disseminating cyber threat intelligence |\n| **TAXII Server** | Component of a TIP that serves STIX bundles to consuming systems on request |\n| **TC Exchange** | ThreatConnect's commercial marketplace for pre-built feed integrations and app connectors |\n| **Multi-tenancy** | TIP capability to serve multiple organizational units or customers with isolated data environments |\n| **Deduplication** | Process of identifying and merging duplicate indicators within a TIP to reduce analyst noise |\n\n## Tools & Systems\n\n- **MISP**: Open-source TIP used by 6,000+ organizations; strongest ISAC\u002Fgovernment community integration\n- **OpenCTI**: Modern open-source TIP with native STIX 2.1 and graph-based analysis\n- **ThreatConnect**: Enterprise commercial TIP with lifecycle management and SOAR playbook integration\n- **Anomali ThreatStream**: Commercial TIP with strong Splunk ecosystem integration\n- **EclecticIQ**: Commercial TIP with ATT&CK-centric workflow design\n\n## Common Pitfalls\n\n- **Selecting TIP before defining requirements**: Technology selection before use case definition leads to expensive mismatches.\n- **Underestimating administration burden**: MISP and OpenCTI require dedicated admin time (minimum 0.25 FTE); budget accordingly.\n- **Ignoring data migration costs**: Moving historical intelligence from one TIP to another is costly and often impractical for legacy systems.\n- **Not testing SIEM integration in PoC**: TIP value depends heavily on downstream integration quality; always test SIEM\u002FSOAR connectivity during evaluation.\n",{"name":5,"tags":49,"author":53,"domain":29,"license":15,"version":54,"category":5,"nist_csf":55,"subdomain":40,"description":7,"mitre_attack":60},[38,50,51,52,37,36,39,35,34],"ThreatConnect","MISP","OpenCTI","team-cybersecurity","1.0.0",[56,57,58,59],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[61,62,63,64],"T1591","T1592","T1593","T1589","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fevaluating-threat-intelligence-platforms",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill evaluating-threat-intelligence-platforms",{"tool":79,"command":80},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill evaluating-threat-intelligence-platforms",{"tool":82,"command":83},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill evaluating-threat-intelligence-platforms","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fevaluating-threat-intelligence-platforms\u002FSKILL.md",true,[87,92,98],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fevaluating-threat-intelligence-platforms\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",2780,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fevaluating-threat-intelligence-platforms\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",9491,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fevaluating-threat-intelligence-platforms\u002Fscripts\u002Fagent.py",[105,134,160,183,199,218],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":114,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[111],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[115,116,117,118,119,120,29,121,122,123,124,125,126,127,128,129,130,131,132,133],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[141,142,143,144,145,29,146,147,148,149,150,151,152,153,154,155,156,157,158,159],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[167,168,131,29,169,170,171,127,128,172,173,174,175,176,177,178,179,180,181,182],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[167,190,191,168,131,145,29,192,170,124,193,194,127,128,195,173,155,196,197,198],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[167,206,207,208,209,210,29,211,212,213,170,214,127,215,216,217,176,32,131,30],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":224,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[225,226,227,26,29,228,229,230,40,231,232,215,233,234,32,25,30,235,236,237],"infrastructure","tracking threat actor infrastructure","tracking","monitoring","mitre-attack","threat-actor","command-and-control","dns","command","exploit","domains","kit","hosts"]