[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HNNM85WFJHBJFXAC2DF8QX":3,"skill-same:01M6HNNM85WFJHBJFXAC2DF8QX":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":6,"ownerHtmlUrl":66,"ownerBlogUrl":6,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6HNNM85WFJHBJFXAC2DF8QX","processing-stix-taxii-feeds",null,"Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fprocessing-stix-taxii-feeds\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"processing","stix","TAXII","feeds","processing stix taxii feeds","STIX-2.1","native","de","intelligence","objects","cm","threat","TAXII-2.1","cybersecurity","NIST-SP-800-150","collection","oasis","NIST","threat-intelligence","threat intelligence","2026-11-10 10:12:30",false,"---\nname: processing-stix-taxii-feeds\ndescription: Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating...\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- STIX-2.1\n- TAXII-2.1\n- OASIS\n- MISP\n- CTI\n- IOC\n- threat-intelligence\n- NIST-SP-800-150\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\ncategory: processing-stix-taxii-feeds\n---\n# Processing-Stix-Taxii-Feeds\n\n## Overview\nProcesses STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.\n\n\n# Processing STIX\u002FTAXII Feeds\n\n## When to Use\n\nUse this skill when:\n- Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider\n- Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import\n- Building automated pipelines that parse STIX relationship objects to reconstruct campaign context\n\n**Do not use** this skill for proprietary vendor feed formats (Recorded Future JSON, CrowdStrike IOC lists) that require vendor-specific parsers rather than STIX processing.\n\n## Prerequisites\n\n- Python 3.9+ with `stix2` library (pip install stix2) and `taxii2-client` library\n- Network access to TAXII 2.1 server endpoint with valid credentials\n- Target TIP or SIEM with import API (MISP, OpenCTI, or Splunk ES)\n\n## Workflow\n\n### Step 1: Discover TAXII Server Collections\n\n```python\nfrom taxii2client.v21 import Server, as_pages\n\nserver = Server(\"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002F\",\n                user=\"apiuser\", password=\"apikey\")\napi_root = server.api_roots[0]\nfor collection in api_root.collections:\n    print(collection.id, collection.title, collection.can_read)\n```\n\nSelect collections relevant to your threat profile. CISA AIS provides collections segmented by sector (financial, energy, healthcare).\n\n### Step 2: Fetch STIX Bundles with Pagination\n\n```python\nfrom taxii2client.v21 import Collection\nfrom datetime import datetime, timedelta, timezone\n\ncollection = Collection(\n    \"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002Fapi1\u002Fcollections\u002F\u003Cid>\u002Fobjects\u002F\",\n    user=\"apiuser\", password=\"apikey\")\n\n# Fetch only objects added in the last 24 hours\nadded_after = datetime.now(timezone.utc) - timedelta(hours=24)\nfor bundle_page in as_pages(collection.get_objects,\n                             added_after=added_after, per_request=100):\n    process_bundle(bundle_page)\n```\n\n### Step 3: Parse and Validate STIX Objects\n\n```python\nimport stix2\n\ndef process_bundle(bundle_dict):\n    bundle = stix2.parse(bundle_dict, allow_custom=True)\n    for obj in bundle.objects:\n        if obj.type == \"indicator\":\n            validate_indicator(obj)\n        elif obj.type == \"threat-actor\":\n            upsert_threat_actor(obj)\n        elif obj.type == \"relationship\":\n            link_objects(obj)\n\ndef validate_indicator(indicator):\n    required = [\"id\", \"type\", \"spec_version\", \"created\",\n                \"modified\", \"pattern\", \"pattern_type\", \"valid_from\"]\n    for field in required:\n        if not hasattr(indicator, field):\n            raise ValueError(f\"Missing required field: {field}\")\n    # Check confidence range\n    if hasattr(indicator, \"confidence\"):\n        assert 0 \u003C= indicator.confidence \u003C= 100\n```\n\n### Step 4: Route Objects to Consuming Platforms\n\nMap STIX object types to destination systems:\n- `indicator` objects → SIEM lookup tables and firewall blocklists\n- `malware` objects → EDR threat intelligence library\n- `threat-actor` \u002F `campaign` objects → TIP for analyst context\n- `course-of-action` objects → Security team wiki or SOAR playbook triggers\n\nUse TLP marking definitions to enforce sharing restrictions:\n```python\nfor marking in obj.get(\"object_marking_refs\", []):\n    if \"tlp-red\" in marking:\n        route_to_restricted_platform_only(obj)\n```\n\n### Step 5: Publish Back to TAXII (Bi-directional Sharing)\n\n```python\n# Add validated local intelligence back to shared collection\nnew_indicator = stix2.Indicator(\n    name=\"Malicious C2 Domain\",\n    pattern=\"[domain-name:value = 'evil-c2.example.com']\",\n    pattern_type=\"stix\",\n    valid_from=\"2025-01-15T00:00:00Z\",\n    confidence=80,\n    labels=[\"malicious-activity\"],\n    object_marking_refs=[\"marking-definition--34098fce-860f-479c-ae...\"]  # TLP:GREEN\n)\ncollection.add_objects(stix2.Bundle(new_indicator))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX Bundle** | Top-level STIX container object (type: \"bundle\") holding any number of STIX Domain Objects (SDOs) and STIX Relationship Objects (SROs) |\n| **SDO** | STIX Domain Object — core intelligence types: indicator, threat-actor, malware, campaign, attack-pattern, course-of-action |\n| **SRO** | STIX Relationship Object — links two SDOs with a labeled relationship (e.g., \"uses\", \"attributed-to\", \"indicates\") |\n| **Pattern Language** | STIX pattern syntax for indicator conditions: `[network-traffic:dst_port = 443 AND ipv4-addr:value = '10.0.0.1']` |\n| **Marking Definition** | STIX object encoding TLP or statement restrictions on intelligence sharing |\n| **added_after** | TAXII 2.1 filter parameter (RFC 3339 timestamp) for incremental polling of new objects |\n\n## Tools & Systems\n\n- **stix2 (Python)**: Official OASIS Python library for creating, parsing, and validating STIX 2.0\u002F2.1 objects\n- **taxii2-client (Python)**: Client library for TAXII 2.0\u002F2.1 server discovery, collection enumeration, and object retrieval\n- **MISP**: Open-source TIP with native TAXII 2.1 server and client; MISP-TAXII-Server plugin for publishing MISP events\n- **OpenCTI**: CTI platform with built-in TAXII 2.1 connector; supports STIX 2.1 import\u002Fexport natively\n- **Cabby**: Legacy Python TAXII 1.x client for older government feeds still on TAXII 1.1\n\n## Common Pitfalls\n\n- **Ignoring `spec_version` field**: STIX 2.0 and 2.1 have incompatible schemas (2.1 adds `confidence`, `object_marking_refs` at bundle level). Always check `spec_version` before parsing.\n- **No pagination handling**: TAXII servers cap responses at 100–1000 objects per request. Missing pagination (via `next` link header) causes silent data loss.\n- **Clock skew on `added_after`**: Server and client time misalignment causes missed objects at interval boundaries. Use UTC exclusively and add 5-minute overlap windows.\n- **Storing raw STIX blobs without indexing**: Storing bundles as opaque JSON prevents querying by indicator type or campaign. Parse into relational or graph database.\n- **Sharing TLP:RED content inadvertently**: Automated pipelines must filter marking definitions before routing to any shared platform or SIEM with broad analyst access.\n","# Processing-Stix-Taxii-Feeds\n\n## Overview\nProcesses STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.\n\n\n# Processing STIX\u002FTAXII Feeds\n\n## When to Use\n\nUse this skill when:\n- Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider\n- Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import\n- Building automated pipelines that parse STIX relationship objects to reconstruct campaign context\n\n**Do not use** this skill for proprietary vendor feed formats (Recorded Future JSON, CrowdStrike IOC lists) that require vendor-specific parsers rather than STIX processing.\n\n## Prerequisites\n\n- Python 3.9+ with `stix2` library (pip install stix2) and `taxii2-client` library\n- Network access to TAXII 2.1 server endpoint with valid credentials\n- Target TIP or SIEM with import API (MISP, OpenCTI, or Splunk ES)\n\n## Workflow\n\n### Step 1: Discover TAXII Server Collections\n\n```python\nfrom taxii2client.v21 import Server, as_pages\n\nserver = Server(\"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002F\",\n                user=\"apiuser\", password=\"apikey\")\napi_root = server.api_roots[0]\nfor collection in api_root.collections:\n    print(collection.id, collection.title, collection.can_read)\n```\n\nSelect collections relevant to your threat profile. CISA AIS provides collections segmented by sector (financial, energy, healthcare).\n\n### Step 2: Fetch STIX Bundles with Pagination\n\n```python\nfrom taxii2client.v21 import Collection\nfrom datetime import datetime, timedelta, timezone\n\ncollection = Collection(\n    \"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002Fapi1\u002Fcollections\u002F\u003Cid>\u002Fobjects\u002F\",\n    user=\"apiuser\", password=\"apikey\")\n\n# Fetch only objects added in the last 24 hours\nadded_after = datetime.now(timezone.utc) - timedelta(hours=24)\nfor bundle_page in as_pages(collection.get_objects,\n                             added_after=added_after, per_request=100):\n    process_bundle(bundle_page)\n```\n\n### Step 3: Parse and Validate STIX Objects\n\n```python\nimport stix2\n\ndef process_bundle(bundle_dict):\n    bundle = stix2.parse(bundle_dict, allow_custom=True)\n    for obj in bundle.objects:\n        if obj.type == \"indicator\":\n            validate_indicator(obj)\n        elif obj.type == \"threat-actor\":\n            upsert_threat_actor(obj)\n        elif obj.type == \"relationship\":\n            link_objects(obj)\n\ndef validate_indicator(indicator):\n    required = [\"id\", \"type\", \"spec_version\", \"created\",\n                \"modified\", \"pattern\", \"pattern_type\", \"valid_from\"]\n    for field in required:\n        if not hasattr(indicator, field):\n            raise ValueError(f\"Missing required field: {field}\")\n    # Check confidence range\n    if hasattr(indicator, \"confidence\"):\n        assert 0 \u003C= indicator.confidence \u003C= 100\n```\n\n### Step 4: Route Objects to Consuming Platforms\n\nMap STIX object types to destination systems:\n- `indicator` objects → SIEM lookup tables and firewall blocklists\n- `malware` objects → EDR threat intelligence library\n- `threat-actor` \u002F `campaign` objects → TIP for analyst context\n- `course-of-action` objects → Security team wiki or SOAR playbook triggers\n\nUse TLP marking definitions to enforce sharing restrictions:\n```python\nfor marking in obj.get(\"object_marking_refs\", []):\n    if \"tlp-red\" in marking:\n        route_to_restricted_platform_only(obj)\n```\n\n### Step 5: Publish Back to TAXII (Bi-directional Sharing)\n\n```python\n# Add validated local intelligence back to shared collection\nnew_indicator = stix2.Indicator(\n    name=\"Malicious C2 Domain\",\n    pattern=\"[domain-name:value = 'evil-c2.example.com']\",\n    pattern_type=\"stix\",\n    valid_from=\"2025-01-15T00:00:00Z\",\n    confidence=80,\n    labels=[\"malicious-activity\"],\n    object_marking_refs=[\"marking-definition--34098fce-860f-479c-ae...\"]  # TLP:GREEN\n)\ncollection.add_objects(stix2.Bundle(new_indicator))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX Bundle** | Top-level STIX container object (type: \"bundle\") holding any number of STIX Domain Objects (SDOs) and STIX Relationship Objects (SROs) |\n| **SDO** | STIX Domain Object — core intelligence types: indicator, threat-actor, malware, campaign, attack-pattern, course-of-action |\n| **SRO** | STIX Relationship Object — links two SDOs with a labeled relationship (e.g., \"uses\", \"attributed-to\", \"indicates\") |\n| **Pattern Language** | STIX pattern syntax for indicator conditions: `[network-traffic:dst_port = 443 AND ipv4-addr:value = '10.0.0.1']` |\n| **Marking Definition** | STIX object encoding TLP or statement restrictions on intelligence sharing |\n| **added_after** | TAXII 2.1 filter parameter (RFC 3339 timestamp) for incremental polling of new objects |\n\n## Tools & Systems\n\n- **stix2 (Python)**: Official OASIS Python library for creating, parsing, and validating STIX 2.0\u002F2.1 objects\n- **taxii2-client (Python)**: Client library for TAXII 2.0\u002F2.1 server discovery, collection enumeration, and object retrieval\n- **MISP**: Open-source TIP with native TAXII 2.1 server and client; MISP-TAXII-Server plugin for publishing MISP events\n- **OpenCTI**: CTI platform with built-in TAXII 2.1 connector; supports STIX 2.1 import\u002Fexport natively\n- **Cabby**: Legacy Python TAXII 1.x client for older government feeds still on TAXII 1.1\n\n## Common Pitfalls\n\n- **Ignoring `spec_version` field**: STIX 2.0 and 2.1 have incompatible schemas (2.1 adds `confidence`, `object_marking_refs` at bundle level). Always check `spec_version` before parsing.\n- **No pagination handling**: TAXII servers cap responses at 100–1000 objects per request. Missing pagination (via `next` link header) causes silent data loss.\n- **Clock skew on `added_after`**: Server and client time misalignment causes missed objects at interval boundaries. Use UTC exclusively and add 5-minute overlap windows.\n- **Storing raw STIX blobs without indexing**: Storing bundles as opaque JSON prevents querying by indicator type or campaign. Parse into relational or graph database.\n- **Sharing TLP:RED content inadvertently**: Automated pipelines must filter marking definitions before routing to any shared platform or SIEM with broad analyst access.\n",{"name":5,"tags":44,"author":49,"domain":32,"license":15,"version":50,"category":5,"nist_csf":51,"subdomain":37,"description":7,"mitre_attack":56},[24,31,45,46,47,48,37,33],"OASIS","MISP","CTI","IOC","mahipal","1.0.0",[52,53,54,55],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[57,58,59,60],"T1591","T1592","T1593","T1589","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fprocessing-stix-taxii-feeds",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill processing-stix-taxii-feeds",{"tool":75,"command":76},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill processing-stix-taxii-feeds",{"tool":78,"command":79},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill processing-stix-taxii-feeds","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fprocessing-stix-taxii-feeds\u002FSKILL.md",true,[83,88,94],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fprocessing-stix-taxii-feeds\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",2282,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fprocessing-stix-taxii-feeds\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",8369,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fprocessing-stix-taxii-feeds\u002Fscripts\u002Fagent.py",[101,132,158,180,196,215],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":112,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[107],{"categoryNo":108,"categoryName":109,"taxonomyType":110,"taxonomyTypeDesc":111},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[113,114,115,116,117,118,32,119,120,121,122,123,124,125,126,127,128,129,130,131],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[139,140,141,142,143,32,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[165,166,129,32,167,168,36,125,126,169,170,171,172,173,174,175,176,177,178,179],"security","triaging security incident","actions","soc","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[165,187,188,166,129,143,32,189,168,122,190,191,125,126,192,170,153,193,194,195],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[165,203,204,205,206,207,32,208,209,210,168,211,125,212,213,214,173,29,129,26],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":221,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[222,223,224,30,32,225,226,227,37,228,229,212,230,231,29,27,26,232,233,234],"infrastructure","tracking threat actor infrastructure","tracking","monitoring","mitre-attack","threat-actor","command-and-control","dns","command","exploit","domains","kit","hosts"]