[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DYB3DDA1VZP12ZM54JZQC":3,"skill-same:01M71DYB3DDA1VZP12ZM54JZQC":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71DYB3DDA1VZP12ZM54JZQC","feeds-feedintegr-detect",null,"Builds automated threat intelligence feed integration pipelines connecting STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Ffeeds\u002Ffeedintegr\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"feeds feedintegr detect","detect","feeds","intelligence","read","de","threat-intelligence","threat intelligence","siem","scoring","alerting","soc","Bash","when","cybersecurity","open","time","cm","distribution","ingestion","2026-11-10 10:12:30",false,"---\nname: feeds-feedintegr-detect\ndescription: Builds automated threat intelligence feed integration pipelines connecting STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- threat-intelligence\n- stix\n- taxii\n- misp\n- feeds\n- ioc\n- siem-integration\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1070\ncapec: []\n---\n\n# Building Threat Intelligence Feed Integration\n\n## When to Use\n\nUse this skill when:\n- SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms\n- Multiple TI sources require normalization into a common format (STIX 2.1)\n- Detection systems need real-time IOC matching against network and endpoint telemetry\n- TI feed quality assessment and deduplication processes need to be established\n\n**Do not use** for manual IOC lookup — use dedicated enrichment tools (VirusTotal, AbuseIPDB) for ad-hoc queries.\n\n## Prerequisites\n\n- MISP instance or Threat Intelligence Platform (TIP) for feed aggregation\n- STIX\u002FTAXII client library (`taxii2-client`, `stix2` Python packages)\n- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with TI framework configured\n- API keys for commercial and open-source feeds (AlienVault OTX, Abuse.ch, CISA AIS)\n- Python 3.8+ for feed processing automation\n\n## Workflow\n\n### Step 1: Identify and Catalog Intelligence Sources\n\nMap available feeds by type, format, and update frequency:\n\n| Feed Source | Format | IOC Types | Update Freq | Cost |\n|-------------|--------|-----------|-------------|------|\n| AlienVault OTX | STIX\u002FJSON | IP, Domain, Hash, URL | Real-time | Free |\n| Abuse.ch URLhaus | CSV\u002FJSON | URL, Domain | Every 5 min | Free |\n| Abuse.ch MalwareBazaar | JSON API | File Hash | Real-time | Free |\n| CISA AIS | STIX\u002FTAXII 2.1 | All types | Daily | Free (US Gov) |\n| CrowdStrike Intel | STIX\u002FJSON | All types + Actor TTP | Real-time | Commercial |\n| Mandiant Advantage | STIX 2.1 | All types + Reports | Real-time | Commercial |\n\n### Step 2: Ingest STIX\u002FTAXII Feeds\n\nConnect to a TAXII 2.1 server and download indicators:\n\n```python\nfrom taxii2client.v21 import Server, Collection\nfrom stix2 import parse\n\n# Connect to TAXII server (example: CISA AIS)\nserver = Server(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# List available collections\nfor api_root in server.api_roots:\n    print(f\"API Root: {api_root.title}\")\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a collection\ncollection = Collection(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# Get indicators added in last 24 hours\nfrom datetime import datetime, timedelta\nadded_after = (datetime.utcnow() - timedelta(days=1)).strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n\nresponse = collection.get_objects(added_after=added_after, type=[\"indicator\"])\nfor obj in response.get(\"objects\", []):\n    indicator = parse(obj)\n    print(f\"Type: {indicator.type}\")\n    print(f\"Pattern: {indicator.pattern}\")\n    print(f\"Valid Until: {indicator.valid_until}\")\n    print(f\"Confidence: {indicator.confidence}\")\n    print(\"---\")\n```\n\n### Step 3: Ingest Open-Source Feeds\n\n**Abuse.ch URLhaus Feed:**\n\n```python\nimport requests\nimport csv\nfrom io import StringIO\n\n# Download URLhaus recent URLs\nresponse = requests.get(\"https:\u002F\u002Furlhaus.abuse.ch\u002Fdownloads\u002Fcsv_recent\u002F\")\nreader = csv.reader(StringIO(response.text), delimiter=',')\n\nindicators = []\nfor row in reader:\n    if row[0].startswith(\"#\"):\n        continue\n    indicators.append({\n        \"id\": row[0],\n        \"dateadded\": row[1],\n        \"url\": row[2],\n        \"url_status\": row[3],\n        \"threat\": row[5],\n        \"tags\": row[6]\n    })\n\nprint(f\"Ingested {len(indicators)} URLs from URLhaus\")\n\n# Filter for active threats only\nactive = [i for i in indicators if i[\"url_status\"] == \"online\"]\nprint(f\"Active threats: {len(active)}\")\n```\n\n**AlienVault OTX Pulse Feed:**\n\n```python\nfrom OTXv2 import OTXv2, IndicatorTypes\n\notx = OTXv2(\"YOUR_OTX_API_KEY\")\n\n# Get subscribed pulses (last 24 hours)\npulses = otx.getall(modified_since=\"2024-03-14T00:00:00\")\n\nfor pulse in pulses:\n    print(f\"Pulse: {pulse['name']}\")\n    print(f\"Tags: {pulse['tags']}\")\n    for indicator in pulse[\"indicators\"]:\n        print(f\"  IOC: {indicator['indicator']} ({indicator['type']})\")\n```\n\n**Abuse.ch Feodo Tracker (C2 IPs):**\n\n```python\nresponse = requests.get(\"https:\u002F\u002Ffeodotracker.abuse.ch\u002Fdownloads\u002Fipblocklist_recommended.json\")\nc2_data = response.json()\n\nfor entry in c2_data:\n    print(f\"IP: {entry['ip_address']}:{entry['port']}\")\n    print(f\"Malware: {entry['malware']}\")\n    print(f\"First Seen: {entry['first_seen']}\")\n    print(f\"Last Online: {entry['last_online']}\")\n```\n\n### Step 4: Normalize and Deduplicate\n\nConvert all feeds to STIX 2.1 format for standardization:\n\n```python\nfrom stix2 import Indicator, Bundle\nimport hashlib\n\ndef create_stix_indicator(ioc_value, ioc_type, source, confidence=50):\n    \"\"\"Convert raw IOC to STIX 2.1 indicator\"\"\"\n    pattern_map = {\n        \"ipv4\": f\"[ipv4-addr:value = '{ioc_value}']\",\n        \"domain\": f\"[domain-name:value = '{ioc_value}']\",\n        \"url\": f\"[url:value = '{ioc_value}']\",\n        \"sha256\": f\"[file:hashes.'SHA-256' = '{ioc_value}']\",\n        \"md5\": f\"[file:hashes.MD5 = '{ioc_value}']\",\n    }\n\n    return Indicator(\n        name=f\"{ioc_type}: {ioc_value}\",\n        pattern=pattern_map[ioc_type],\n        pattern_type=\"stix\",\n        valid_from=\"2024-03-15T00:00:00Z\",\n        confidence=confidence,\n        labels=[source],\n        custom_properties={\"x_source_feed\": source}\n    )\n\n# Deduplicate across sources\nseen_iocs = set()\nunique_indicators = []\n\nfor ioc in all_collected_iocs:\n    ioc_hash = hashlib.sha256(f\"{ioc['type']}:{ioc['value']}\".encode()).hexdigest()\n    if ioc_hash not in seen_iocs:\n        seen_iocs.add(ioc_hash)\n        unique_indicators.append(\n            create_stix_indicator(ioc[\"value\"], ioc[\"type\"], ioc[\"source\"])\n        )\n\nbundle = Bundle(objects=unique_indicators)\nprint(f\"Unique indicators: {len(unique_indicators)}\")\n```\n\n### Step 5: Push to SIEM Threat Intelligence Framework\n\n**Push to Splunk ES Threat Intelligence:**\n\n```python\nimport requests\n\nsplunk_url = \"https:\u002F\u002Fsplunk.company.com:8089\"\nheaders = {\"Authorization\": f\"Bearer {splunk_token}\"}\n\nfor indicator in unique_indicators:\n    # Extract IOC value from STIX pattern\n    ioc_value = indicator.pattern.split(\"'\")[1]\n\n    # Upload to Splunk ES threat intel collection\n    data = {\n        \"ip\": ioc_value,\n        \"description\": indicator.name,\n        \"weight\": indicator.confidence \u002F\u002F 10,\n        \"threat_key\": indicator.id,\n        \"source_feed\": indicator.get(\"x_source_feed\", \"unknown\")\n    }\n\n    requests.post(\n        f\"{splunk_url}\u002Fservices\u002Fdata\u002Fthreat_intel\u002Fitem\u002Fip_intel\",\n        headers=headers, data=data,\n        verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n    )\n```\n\n**Push to MISP for centralized management:**\n\n```python\nfrom pymisp import PyMISP, MISPEvent, MISPAttribute\n\nmisp = PyMISP(\"https:\u002F\u002Fmisp.company.com\", \"YOUR_MISP_API_KEY\")\n\n# Create event for feed batch\nevent = MISPEvent()\nevent.info = f\"TI Feed Import - {datetime.now().strftime('%Y-%m-%d')}\"\nevent.threat_level_id = 2  # Medium\nevent.analysis = 2  # Completed\n\n# Add indicators as attributes\nfor ioc in unique_indicators:\n    attr = MISPAttribute()\n    attr.type = \"ip-dst\" if \"ipv4\" in ioc.pattern else \"domain\"\n    attr.value = ioc.pattern.split(\"'\")[1]\n    attr.to_ids = True\n    attr.comment = f\"Source: {ioc.get('x_source_feed', 'mixed')}\"\n    event.add_attribute(**attr)\n\nresult = misp.add_event(event)\nprint(f\"MISP Event created: {result['Event']['id']}\")\n```\n\n### Step 6: Monitor Feed Health and Quality\n\nTrack feed effectiveness metrics:\n\n```spl\nindex=threat_intel sourcetype=\"threat_intel_manager\"\n| stats count AS total_iocs,\n        dc(threat_key) AS unique_iocs,\n        dc(source_feed) AS feed_count\n  by source_feed\n| join source_feed [\n    search index=notable source=\"Threat Intelligence\"\n    | stats count AS matches by source_feed\n  ]\n| eval match_rate = round(matches \u002F unique_iocs * 100, 2)\n| sort - match_rate\n| table source_feed, unique_iocs, matches, match_rate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — standardized JSON format for sharing threat intelligence objects |\n| **TAXII** | Trusted Automated eXchange of Indicator Information — transport protocol for sharing STIX data via REST API |\n| **TIP** | Threat Intelligence Platform — centralized system for aggregating, scoring, and distributing threat intelligence |\n| **IOC Scoring** | Process of assigning confidence values to indicators based on source reliability and corroboration |\n| **Feed Deduplication** | Removing duplicate IOCs across multiple sources while preserving multi-source attribution |\n| **IOC Expiration** | Time-to-live policy removing aged indicators (IP: 30 days, Domain: 90 days, Hash: 1 year) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence platform for feed aggregation, correlation, and sharing\n- **AlienVault OTX**: Free threat intelligence sharing platform with community pulse feeds\n- **Abuse.ch**: Suite of free threat feeds (URLhaus, MalwareBazaar, Feodo Tracker, ThreatFox)\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 native storage\n- **TAXII2 Client**: Python library for connecting to STIX\u002FTAXII 2.1 servers for automated indicator retrieval\n\n## Common Scenarios\n\n- **New Feed Onboarding**: Evaluate feed quality, map fields to STIX, configure automated ingestion pipeline\n- **Multi-SIEM Distribution**: Push normalized IOCs from MISP to Splunk, Elastic, and Sentinel simultaneously\n- **False Positive Reduction**: Score IOCs by source count and age, expire stale indicators automatically\n- **Feed Quality Audit**: Compare detection match rates across feeds to identify highest-value sources\n- **Incident IOC Sharing**: Package investigation IOCs as STIX bundle and share with ISACs via TAXII\n\n## Output Format\n\n```\nTHREAT INTEL FEED STATUS — Daily Report\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-15\nTotal IOCs:   45,892 active indicators\n\nFeed Health:\n  Feed                  IOCs    Matches  Match Rate  Status\n  Abuse.ch URLhaus      12,340  47       0.38%       HEALTHY\n  AlienVault OTX        18,567  23       0.12%       HEALTHY\n  Abuse.ch Feodo        1,203   12       1.00%       HEALTHY\n  CISA AIS              8,945   8        0.09%       HEALTHY\n  CrowdStrike Intel     4,837   31       0.64%       HEALTHY\n\nActions Today:\n  New IOCs ingested:    1,247\n  IOCs expired:         892\n  Duplicates removed:   156\n  SIEM matches:         121 notable events generated\n  False positives:      3 (CDN IPs removed from feed)\n```\n","# Building Threat Intelligence Feed Integration\n\n## When to Use\n\nUse this skill when:\n- SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms\n- Multiple TI sources require normalization into a common format (STIX 2.1)\n- Detection systems need real-time IOC matching against network and endpoint telemetry\n- TI feed quality assessment and deduplication processes need to be established\n\n**Do not use** for manual IOC lookup — use dedicated enrichment tools (VirusTotal, AbuseIPDB) for ad-hoc queries.\n\n## Prerequisites\n\n- MISP instance or Threat Intelligence Platform (TIP) for feed aggregation\n- STIX\u002FTAXII client library (`taxii2-client`, `stix2` Python packages)\n- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with TI framework configured\n- API keys for commercial and open-source feeds (AlienVault OTX, Abuse.ch, CISA AIS)\n- Python 3.8+ for feed processing automation\n\n## Workflow\n\n### Step 1: Identify and Catalog Intelligence Sources\n\nMap available feeds by type, format, and update frequency:\n\n| Feed Source | Format | IOC Types | Update Freq | Cost |\n|-------------|--------|-----------|-------------|------|\n| AlienVault OTX | STIX\u002FJSON | IP, Domain, Hash, URL | Real-time | Free |\n| Abuse.ch URLhaus | CSV\u002FJSON | URL, Domain | Every 5 min | Free |\n| Abuse.ch MalwareBazaar | JSON API | File Hash | Real-time | Free |\n| CISA AIS | STIX\u002FTAXII 2.1 | All types | Daily | Free (US Gov) |\n| CrowdStrike Intel | STIX\u002FJSON | All types + Actor TTP | Real-time | Commercial |\n| Mandiant Advantage | STIX 2.1 | All types + Reports | Real-time | Commercial |\n\n### Step 2: Ingest STIX\u002FTAXII Feeds\n\nConnect to a TAXII 2.1 server and download indicators:\n\n```python\nfrom taxii2client.v21 import Server, Collection\nfrom stix2 import parse\n\n# Connect to TAXII server (example: CISA AIS)\nserver = Server(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# List available collections\nfor api_root in server.api_roots:\n    print(f\"API Root: {api_root.title}\")\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a collection\ncollection = Collection(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# Get indicators added in last 24 hours\nfrom datetime import datetime, timedelta\nadded_after = (datetime.utcnow() - timedelta(days=1)).strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n\nresponse = collection.get_objects(added_after=added_after, type=[\"indicator\"])\nfor obj in response.get(\"objects\", []):\n    indicator = parse(obj)\n    print(f\"Type: {indicator.type}\")\n    print(f\"Pattern: {indicator.pattern}\")\n    print(f\"Valid Until: {indicator.valid_until}\")\n    print(f\"Confidence: {indicator.confidence}\")\n    print(\"---\")\n```\n\n### Step 3: Ingest Open-Source Feeds\n\n**Abuse.ch URLhaus Feed:**\n\n```python\nimport requests\nimport csv\nfrom io import StringIO\n\n# Download URLhaus recent URLs\nresponse = requests.get(\"https:\u002F\u002Furlhaus.abuse.ch\u002Fdownloads\u002Fcsv_recent\u002F\")\nreader = csv.reader(StringIO(response.text), delimiter=',')\n\nindicators = []\nfor row in reader:\n    if row[0].startswith(\"#\"):\n        continue\n    indicators.append({\n        \"id\": row[0],\n        \"dateadded\": row[1],\n        \"url\": row[2],\n        \"url_status\": row[3],\n        \"threat\": row[5],\n        \"tags\": row[6]\n    })\n\nprint(f\"Ingested {len(indicators)} URLs from URLhaus\")\n\n# Filter for active threats only\nactive = [i for i in indicators if i[\"url_status\"] == \"online\"]\nprint(f\"Active threats: {len(active)}\")\n```\n\n**AlienVault OTX Pulse Feed:**\n\n```python\nfrom OTXv2 import OTXv2, IndicatorTypes\n\notx = OTXv2(\"YOUR_OTX_API_KEY\")\n\n# Get subscribed pulses (last 24 hours)\npulses = otx.getall(modified_since=\"2024-03-14T00:00:00\")\n\nfor pulse in pulses:\n    print(f\"Pulse: {pulse['name']}\")\n    print(f\"Tags: {pulse['tags']}\")\n    for indicator in pulse[\"indicators\"]:\n        print(f\"  IOC: {indicator['indicator']} ({indicator['type']})\")\n```\n\n**Abuse.ch Feodo Tracker (C2 IPs):**\n\n```python\nresponse = requests.get(\"https:\u002F\u002Ffeodotracker.abuse.ch\u002Fdownloads\u002Fipblocklist_recommended.json\")\nc2_data = response.json()\n\nfor entry in c2_data:\n    print(f\"IP: {entry['ip_address']}:{entry['port']}\")\n    print(f\"Malware: {entry['malware']}\")\n    print(f\"First Seen: {entry['first_seen']}\")\n    print(f\"Last Online: {entry['last_online']}\")\n```\n\n### Step 4: Normalize and Deduplicate\n\nConvert all feeds to STIX 2.1 format for standardization:\n\n```python\nfrom stix2 import Indicator, Bundle\nimport hashlib\n\ndef create_stix_indicator(ioc_value, ioc_type, source, confidence=50):\n    \"\"\"Convert raw IOC to STIX 2.1 indicator\"\"\"\n    pattern_map = {\n        \"ipv4\": f\"[ipv4-addr:value = '{ioc_value}']\",\n        \"domain\": f\"[domain-name:value = '{ioc_value}']\",\n        \"url\": f\"[url:value = '{ioc_value}']\",\n        \"sha256\": f\"[file:hashes.'SHA-256' = '{ioc_value}']\",\n        \"md5\": f\"[file:hashes.MD5 = '{ioc_value}']\",\n    }\n\n    return Indicator(\n        name=f\"{ioc_type}: {ioc_value}\",\n        pattern=pattern_map[ioc_type],\n        pattern_type=\"stix\",\n        valid_from=\"2024-03-15T00:00:00Z\",\n        confidence=confidence,\n        labels=[source],\n        custom_properties={\"x_source_feed\": source}\n    )\n\n# Deduplicate across sources\nseen_iocs = set()\nunique_indicators = []\n\nfor ioc in all_collected_iocs:\n    ioc_hash = hashlib.sha256(f\"{ioc['type']}:{ioc['value']}\".encode()).hexdigest()\n    if ioc_hash not in seen_iocs:\n        seen_iocs.add(ioc_hash)\n        unique_indicators.append(\n            create_stix_indicator(ioc[\"value\"], ioc[\"type\"], ioc[\"source\"])\n        )\n\nbundle = Bundle(objects=unique_indicators)\nprint(f\"Unique indicators: {len(unique_indicators)}\")\n```\n\n### Step 5: Push to SIEM Threat Intelligence Framework\n\n**Push to Splunk ES Threat Intelligence:**\n\n```python\nimport requests\n\nsplunk_url = \"https:\u002F\u002Fsplunk.company.com:8089\"\nheaders = {\"Authorization\": f\"Bearer {splunk_token}\"}\n\nfor indicator in unique_indicators:\n    # Extract IOC value from STIX pattern\n    ioc_value = indicator.pattern.split(\"'\")[1]\n\n    # Upload to Splunk ES threat intel collection\n    data = {\n        \"ip\": ioc_value,\n        \"description\": indicator.name,\n        \"weight\": indicator.confidence \u002F\u002F 10,\n        \"threat_key\": indicator.id,\n        \"source_feed\": indicator.get(\"x_source_feed\", \"unknown\")\n    }\n\n    requests.post(\n        f\"{splunk_url}\u002Fservices\u002Fdata\u002Fthreat_intel\u002Fitem\u002Fip_intel\",\n        headers=headers, data=data,\n        verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n    )\n```\n\n**Push to MISP for centralized management:**\n\n```python\nfrom pymisp import PyMISP, MISPEvent, MISPAttribute\n\nmisp = PyMISP(\"https:\u002F\u002Fmisp.company.com\", \"YOUR_MISP_API_KEY\")\n\n# Create event for feed batch\nevent = MISPEvent()\nevent.info = f\"TI Feed Import - {datetime.now().strftime('%Y-%m-%d')}\"\nevent.threat_level_id = 2  # Medium\nevent.analysis = 2  # Completed\n\n# Add indicators as attributes\nfor ioc in unique_indicators:\n    attr = MISPAttribute()\n    attr.type = \"ip-dst\" if \"ipv4\" in ioc.pattern else \"domain\"\n    attr.value = ioc.pattern.split(\"'\")[1]\n    attr.to_ids = True\n    attr.comment = f\"Source: {ioc.get('x_source_feed', 'mixed')}\"\n    event.add_attribute(**attr)\n\nresult = misp.add_event(event)\nprint(f\"MISP Event created: {result['Event']['id']}\")\n```\n\n### Step 6: Monitor Feed Health and Quality\n\nTrack feed effectiveness metrics:\n\n```spl\nindex=threat_intel sourcetype=\"threat_intel_manager\"\n| stats count AS total_iocs,\n        dc(threat_key) AS unique_iocs,\n        dc(source_feed) AS feed_count\n  by source_feed\n| join source_feed [\n    search index=notable source=\"Threat Intelligence\"\n    | stats count AS matches by source_feed\n  ]\n| eval match_rate = round(matches \u002F unique_iocs * 100, 2)\n| sort - match_rate\n| table source_feed, unique_iocs, matches, match_rate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — standardized JSON format for sharing threat intelligence objects |\n| **TAXII** | Trusted Automated eXchange of Indicator Information — transport protocol for sharing STIX data via REST API |\n| **TIP** | Threat Intelligence Platform — centralized system for aggregating, scoring, and distributing threat intelligence |\n| **IOC Scoring** | Process of assigning confidence values to indicators based on source reliability and corroboration |\n| **Feed Deduplication** | Removing duplicate IOCs across multiple sources while preserving multi-source attribution |\n| **IOC Expiration** | Time-to-live policy removing aged indicators (IP: 30 days, Domain: 90 days, Hash: 1 year) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence platform for feed aggregation, correlation, and sharing\n- **AlienVault OTX**: Free threat intelligence sharing platform with community pulse feeds\n- **Abuse.ch**: Suite of free threat feeds (URLhaus, MalwareBazaar, Feodo Tracker, ThreatFox)\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 native storage\n- **TAXII2 Client**: Python library for connecting to STIX\u002FTAXII 2.1 servers for automated indicator retrieval\n\n## Common Scenarios\n\n- **New Feed Onboarding**: Evaluate feed quality, map fields to STIX, configure automated ingestion pipeline\n- **Multi-SIEM Distribution**: Push normalized IOCs from MISP to Splunk, Elastic, and Sentinel simultaneously\n- **False Positive Reduction**: Score IOCs by source count and age, expire stale indicators automatically\n- **Feed Quality Audit**: Compare detection match rates across feeds to identify highest-value sources\n- **Incident IOC Sharing**: Package investigation IOCs as STIX bundle and share with ISACs via TAXII\n\n## Output Format\n\n```\nTHREAT INTEL FEED STATUS — Daily Report\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-15\nTotal IOCs:   45,892 active indicators\n\nFeed Health:\n  Feed                  IOCs    Matches  Match Rate  Status\n  Abuse.ch URLhaus      12,340  47       0.38%       HEALTHY\n  AlienVault OTX        18,567  23       0.12%       HEALTHY\n  Abuse.ch Feodo        1,203   12       1.00%       HEALTHY\n  CISA AIS              8,945   8        0.09%       HEALTHY\n  CrowdStrike Intel     4,837   31       0.64%       HEALTHY\n\nActions Today:\n  New IOCs ingested:    1,247\n  IOCs expired:         892\n  Duplicates removed:   156\n  SIEM matches:         121 notable events generated\n  False positives:      3 (CDN IPs removed from feed)\n```\n",{"name":5,"tags":44,"capec":50,"model":51,"tools":52,"domain":33,"maxTurns":56,"nist_csf":57,"subdomain":62,"description":7,"mitre_attack":63},[30,25,45,46,47,21,48,49],"stix","taxii","misp","ioc","siem-integration",[],"sonnet",[53,31,54,55],"Read","Glob","Grep",20,[58,59,60,61],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[64,65],"T1059","T1070","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fintel\u002Ffeeds\u002Ffeedintegr\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill feeds-feedintegr-detect",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill feeds-feedintegr-detect",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill feeds-feedintegr-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Ffeeds\u002Ffeedintegr\u002Fdetect\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",680,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Ffeeds\u002Ffeedintegr\u002Fdetect\u002Findex.json",[94,116,137,158,180,196],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,20,102,103,104,24,36,105,106,107,108,109,110,111,112,113,114,33,115],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[123,101,124,103,125,126,127,33,31,128,129,130,131,132,24,133,134,23,135,136],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[144,145,146,147,148,149,33,31,150,128,151,152,24,23,153,154,155,156,157,51],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[20,165,166,167,168,169,170,36,171,33,115,172,173,174,175,176,177,178,179,24],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[187,188,20,189,167,169,190,36,191,171,33,115,128,192,193,194,195,179,24,105],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[203,20,167,204,190,36,205,206,33,115,207,208,209,210,211,212,24,105,213,214],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]