[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71E154YV3WHPH3HSCJ81J8Y":3,"skill-same:01M71E154YV3WHPH3HSCJ81J8Y":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71E154YV3WHPH3HSCJ81J8Y","platforms-threat-hunt",null,"Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fplatforms\u002Fthreat\u002Fhunt\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"threat","hunt","platforms threat hunt","system","for","platform","sonnet","Tools","intelligence","analyzing","read","de","threat-intelligence","threat intelligence","mitre-attack","Bash","cybersecurity","cm","platform-building","TIP","2026-11-10 10:12:30",false,"---\nname: platforms-threat-hunt\ndescription: Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- platform-building\n- misp\n- opencti\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Building Threat Intelligence Platform\n\n## Overview\n\nBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX\u002FTAXII interoperability, and building analyst dashboards for CTI operations.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence platform capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deploying platform components\n- Python 3.9+ with `pymisp`, `pycti`, `thehive4py` libraries\n- Elasticsearch\u002FOpenSearch cluster for data storage\n- Redis and RabbitMQ for message queuing\n- Understanding of STIX 2.1 data model and TAXII 2.1 transport\n- API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)\n\n## Key Concepts\n\n### TIP Architecture Components\n1. **Collection Layer**: Feed ingestion from OSINT, commercial, and internal sources\n2. **Storage Layer**: Elasticsearch\u002FOpenSearch for indexed CTI data with STIX 2.1 schema\n3. **Analysis Layer**: OpenCTI for knowledge graph analysis and MISP for IOC correlation\n4. **Enrichment Layer**: Cortex analyzers for automated IOC enrichment\n5. **Response Layer**: TheHive for case management and incident response integration\n6. **Sharing Layer**: TAXII server for outbound intelligence sharing\n\n### Platform Integration Points\n- **MISP \u003C-> OpenCTI**: Bidirectional sync via OpenCTI MISP connector\n- **OpenCTI \u003C-> TheHive**: Alert\u002Fcase creation from high-confidence indicators\n- **TheHive \u003C-> Cortex**: Automated analysis and enrichment of case observables\n- **All \u003C-> SIEM**: Real-time IOC push to Splunk\u002FElastic via API or Kafka\n\n## Workflow\n\n### Step 1: Deploy Platform with Docker Compose\n\n```yaml\nservices:\n  # --- Storage Layer ---\n  elasticsearch:\n    image: docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.12.0\n    environment:\n      - discovery.type=single-node\n      - xpack.security.enabled=false\n      - \"ES_JAVA_OPTS=-Xms2g -Xmx2g\"\n    ports:\n      - \"9200:9200\"\n    volumes:\n      - es-data:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n\n  redis:\n    image: redis:7\n    ports:\n      - \"6379:6379\"\n\n  rabbitmq:\n    image: rabbitmq:3-management\n    ports:\n      - \"5672:5672\"\n      - \"15672:15672\"\n\n  minio:\n    image: minio\u002Fminio\n    command: server \u002Fdata --console-address \":9001\"\n    ports:\n      - \"9000:9000\"\n      - \"9001:9001\"\n\n  # --- MISP ---\n  misp:\n    image: ghcr.io\u002Fmisp\u002Fmisp-docker\u002Fmisp-core:latest\n    ports:\n      - \"8443:443\"\n    environment:\n      - MISP_ADMIN_EMAIL=admin@tip.local\n      - MISP_BASEURL=https:\u002F\u002Flocalhost:8443\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n\n  # --- OpenCTI ---\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@tip.local\n      - APP__ADMIN__PASSWORD=TIPAdminPassword\n      - APP__ADMIN__TOKEN=tip-opencti-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n      - REDIS__HOSTNAME=redis\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - redis\n      - rabbitmq\n      - minio\n\n  # --- TheHive ---\n  thehive:\n    image: strangebee\u002Fthehive:5.3\n    environment:\n      - TH_CORTEX_URL=http:\u002F\u002Fcortex:9001\n    ports:\n      - \"9000:9000\"\n    depends_on:\n      - elasticsearch\n\n  # --- Cortex ---\n  cortex:\n    image: thehiveproject\u002Fcortex:3.1.8\n    ports:\n      - \"9001:9001\"\n    depends_on:\n      - elasticsearch\n\nvolumes:\n  es-data:\n  misp-data:\n```\n\n### Step 2: Configure Feed Ingestion Pipeline\n\n```python\nfrom pymisp import PyMISP\nfrom pycti import OpenCTIApiClient\nimport json\n\nclass TIPFeedManager:\n    \"\"\"Manage threat intelligence feed ingestion across platform components.\"\"\"\n\n    def __init__(self, misp_url, misp_key, opencti_url, opencti_token):\n        self.misp = PyMISP(misp_url, misp_key, ssl=False)\n        self.opencti = OpenCTIApiClient(opencti_url, opencti_token)\n\n    def configure_osint_feeds(self):\n        \"\"\"Enable default OSINT feeds in MISP.\"\"\"\n        osint_feeds = [\n            {\"name\": \"CIRCL OSINT\", \"id\": 1},\n            {\"name\": \"Botvrij.eu\", \"id\": 2},\n            {\"name\": \"abuse.ch URLhaus\", \"id\": 5},\n            {\"name\": \"abuse.ch Feodo Tracker\", \"id\": 6},\n        ]\n        for feed in osint_feeds:\n            try:\n                self.misp.enable_feed(feed[\"id\"])\n                self.misp.fetch_feed(feed[\"id\"])\n                print(f\"[+] Enabled feed: {feed['name']}\")\n            except Exception as e:\n                print(f\"[-] Failed: {feed['name']}: {e}\")\n\n    def configure_opencti_connectors(self):\n        \"\"\"List and verify OpenCTI connector status.\"\"\"\n        connectors = self.opencti.connector.list()\n        for conn in connectors:\n            print(\n                f\"  Connector: {conn['name']} - \"\n                f\"Active: {conn['active']} - \"\n                f\"Type: {conn['connector_type']}\"\n            )\n\n    def sync_misp_to_opencti(self):\n        \"\"\"Verify MISP-OpenCTI sync is operational.\"\"\"\n        # OpenCTI MISP connector handles this automatically\n        # Check connector status\n        connectors = self.opencti.connector.list()\n        misp_connector = [\n            c for c in connectors if \"misp\" in c[\"name\"].lower()\n        ]\n        if misp_connector:\n            print(f\"[+] MISP connector active: {misp_connector[0]['active']}\")\n        else:\n            print(\"[-] MISP connector not found - configure in Docker Compose\")\n```\n\n### Step 3: Build Enrichment Pipeline with Cortex\n\n```python\nimport requests\n\nclass CortexEnrichment:\n    \"\"\"Integrate Cortex analyzers for automated enrichment.\"\"\"\n\n    def __init__(self, cortex_url, cortex_key):\n        self.url = cortex_url\n        self.headers = {\"Authorization\": f\"Bearer {cortex_key}\"}\n\n    def list_analyzers(self):\n        \"\"\"List available Cortex analyzers.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\",\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            analyzers = resp.json()\n            for a in analyzers:\n                print(f\"  {a['name']}: {a.get('description', '')[:60]}\")\n            return analyzers\n        return []\n\n    def analyze_observable(self, observable_type, observable_value, analyzer_id):\n        \"\"\"Submit an observable for analysis.\"\"\"\n        job = {\n            \"data\": observable_value,\n            \"dataType\": observable_type,\n            \"tlp\": 2,\n            \"message\": \"TIP automated enrichment\",\n        }\n        resp = requests.post(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\u002F{analyzer_id}\u002Frun\",\n            json=job,\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n\n    def get_job_report(self, job_id):\n        \"\"\"Get the report for a completed analysis job.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fjob\u002F{job_id}\u002Freport\",\n            headers=self.headers,\n            timeout=60,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n```\n\n### Step 4: Implement Analyst Dashboard Metrics\n\n```python\nclass TIPMetrics:\n    \"\"\"Collect platform metrics for analyst dashboards.\"\"\"\n\n    def __init__(self, misp, opencti):\n        self.misp = misp\n        self.opencti = opencti\n\n    def get_platform_stats(self):\n        \"\"\"Collect statistics across all platform components.\"\"\"\n        stats = {}\n\n        # MISP stats\n        misp_stats = self.misp.get_server_statistics()\n        stats[\"misp\"] = {\n            \"total_events\": misp_stats.get(\"event_count\", 0),\n            \"total_attributes\": misp_stats.get(\"attribute_count\", 0),\n            \"active_feeds\": len([\n                f for f in self.misp.feeds()\n                if f.get(\"Feed\", {}).get(\"enabled\")\n            ]),\n        }\n\n        # OpenCTI stats via GraphQL\n        stats[\"opencti\"] = {\n            \"total_indicators\": self.opencti.indicator.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n            \"total_reports\": self.opencti.report.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n        }\n\n        return stats\n```\n\n## Validation Criteria\n\n- All platform components (MISP, OpenCTI, TheHive, Cortex) deployed and accessible\n- MISP-OpenCTI bidirectional sync operational\n- At least 3 OSINT feeds ingesting data\n- Cortex analyzers configured and returning enrichment results\n- Platform metrics dashboard showing real-time statistics\n- STIX\u002FTAXII export functional for intelligence sharing\n\n## References\n\n- [OpenCTI Documentation](https:\u002F\u002Fdocs.opencti.io\u002F)\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [TheHive Project](https:\u002F\u002Fthehive-project.org\u002F)\n- [Cortex Documentation](https:\u002F\u002Fgithub.com\u002FTheHive-Project\u002FCortex)\n- [MISP-OpenCTI Integration](https:\u002F\u002Fdocs.opencti.io\u002Flatest\u002Fdeployment\u002Fconnectors\u002F)\n","# Building Threat Intelligence Platform\n\n## Overview\n\nBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX\u002FTAXII interoperability, and building analyst dashboards for CTI operations.\n\n\n## When to Use\n\n- When deploying or configuring building threat intelligence platform capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Docker and Docker Compose for deploying platform components\n- Python 3.9+ with `pymisp`, `pycti`, `thehive4py` libraries\n- Elasticsearch\u002FOpenSearch cluster for data storage\n- Redis and RabbitMQ for message queuing\n- Understanding of STIX 2.1 data model and TAXII 2.1 transport\n- API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)\n\n## Key Concepts\n\n### TIP Architecture Components\n1. **Collection Layer**: Feed ingestion from OSINT, commercial, and internal sources\n2. **Storage Layer**: Elasticsearch\u002FOpenSearch for indexed CTI data with STIX 2.1 schema\n3. **Analysis Layer**: OpenCTI for knowledge graph analysis and MISP for IOC correlation\n4. **Enrichment Layer**: Cortex analyzers for automated IOC enrichment\n5. **Response Layer**: TheHive for case management and incident response integration\n6. **Sharing Layer**: TAXII server for outbound intelligence sharing\n\n### Platform Integration Points\n- **MISP \u003C-> OpenCTI**: Bidirectional sync via OpenCTI MISP connector\n- **OpenCTI \u003C-> TheHive**: Alert\u002Fcase creation from high-confidence indicators\n- **TheHive \u003C-> Cortex**: Automated analysis and enrichment of case observables\n- **All \u003C-> SIEM**: Real-time IOC push to Splunk\u002FElastic via API or Kafka\n\n## Workflow\n\n### Step 1: Deploy Platform with Docker Compose\n\n```yaml\nservices:\n  # --- Storage Layer ---\n  elasticsearch:\n    image: docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.12.0\n    environment:\n      - discovery.type=single-node\n      - xpack.security.enabled=false\n      - \"ES_JAVA_OPTS=-Xms2g -Xmx2g\"\n    ports:\n      - \"9200:9200\"\n    volumes:\n      - es-data:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n\n  redis:\n    image: redis:7\n    ports:\n      - \"6379:6379\"\n\n  rabbitmq:\n    image: rabbitmq:3-management\n    ports:\n      - \"5672:5672\"\n      - \"15672:15672\"\n\n  minio:\n    image: minio\u002Fminio\n    command: server \u002Fdata --console-address \":9001\"\n    ports:\n      - \"9000:9000\"\n      - \"9001:9001\"\n\n  # --- MISP ---\n  misp:\n    image: ghcr.io\u002Fmisp\u002Fmisp-docker\u002Fmisp-core:latest\n    ports:\n      - \"8443:443\"\n    environment:\n      - MISP_ADMIN_EMAIL=admin@tip.local\n      - MISP_BASEURL=https:\u002F\u002Flocalhost:8443\n    volumes:\n      - misp-data:\u002Fvar\u002Fwww\u002FMISP\u002Fapp\u002Ffiles\n\n  # --- OpenCTI ---\n  opencti:\n    image: opencti\u002Fplatform:6.4.4\n    environment:\n      - APP__PORT=8080\n      - APP__ADMIN__EMAIL=admin@tip.local\n      - APP__ADMIN__PASSWORD=TIPAdminPassword\n      - APP__ADMIN__TOKEN=tip-opencti-token-uuid\n      - ELASTICSEARCH__URL=http:\u002F\u002Felasticsearch:9200\n      - MINIO__ENDPOINT=minio\n      - RABBITMQ__HOSTNAME=rabbitmq\n      - REDIS__HOSTNAME=redis\n    ports:\n      - \"8080:8080\"\n    depends_on:\n      - elasticsearch\n      - redis\n      - rabbitmq\n      - minio\n\n  # --- TheHive ---\n  thehive:\n    image: strangebee\u002Fthehive:5.3\n    environment:\n      - TH_CORTEX_URL=http:\u002F\u002Fcortex:9001\n    ports:\n      - \"9000:9000\"\n    depends_on:\n      - elasticsearch\n\n  # --- Cortex ---\n  cortex:\n    image: thehiveproject\u002Fcortex:3.1.8\n    ports:\n      - \"9001:9001\"\n    depends_on:\n      - elasticsearch\n\nvolumes:\n  es-data:\n  misp-data:\n```\n\n### Step 2: Configure Feed Ingestion Pipeline\n\n```python\nfrom pymisp import PyMISP\nfrom pycti import OpenCTIApiClient\nimport json\n\nclass TIPFeedManager:\n    \"\"\"Manage threat intelligence feed ingestion across platform components.\"\"\"\n\n    def __init__(self, misp_url, misp_key, opencti_url, opencti_token):\n        self.misp = PyMISP(misp_url, misp_key, ssl=False)\n        self.opencti = OpenCTIApiClient(opencti_url, opencti_token)\n\n    def configure_osint_feeds(self):\n        \"\"\"Enable default OSINT feeds in MISP.\"\"\"\n        osint_feeds = [\n            {\"name\": \"CIRCL OSINT\", \"id\": 1},\n            {\"name\": \"Botvrij.eu\", \"id\": 2},\n            {\"name\": \"abuse.ch URLhaus\", \"id\": 5},\n            {\"name\": \"abuse.ch Feodo Tracker\", \"id\": 6},\n        ]\n        for feed in osint_feeds:\n            try:\n                self.misp.enable_feed(feed[\"id\"])\n                self.misp.fetch_feed(feed[\"id\"])\n                print(f\"[+] Enabled feed: {feed['name']}\")\n            except Exception as e:\n                print(f\"[-] Failed: {feed['name']}: {e}\")\n\n    def configure_opencti_connectors(self):\n        \"\"\"List and verify OpenCTI connector status.\"\"\"\n        connectors = self.opencti.connector.list()\n        for conn in connectors:\n            print(\n                f\"  Connector: {conn['name']} - \"\n                f\"Active: {conn['active']} - \"\n                f\"Type: {conn['connector_type']}\"\n            )\n\n    def sync_misp_to_opencti(self):\n        \"\"\"Verify MISP-OpenCTI sync is operational.\"\"\"\n        # OpenCTI MISP connector handles this automatically\n        # Check connector status\n        connectors = self.opencti.connector.list()\n        misp_connector = [\n            c for c in connectors if \"misp\" in c[\"name\"].lower()\n        ]\n        if misp_connector:\n            print(f\"[+] MISP connector active: {misp_connector[0]['active']}\")\n        else:\n            print(\"[-] MISP connector not found - configure in Docker Compose\")\n```\n\n### Step 3: Build Enrichment Pipeline with Cortex\n\n```python\nimport requests\n\nclass CortexEnrichment:\n    \"\"\"Integrate Cortex analyzers for automated enrichment.\"\"\"\n\n    def __init__(self, cortex_url, cortex_key):\n        self.url = cortex_url\n        self.headers = {\"Authorization\": f\"Bearer {cortex_key}\"}\n\n    def list_analyzers(self):\n        \"\"\"List available Cortex analyzers.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\",\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            analyzers = resp.json()\n            for a in analyzers:\n                print(f\"  {a['name']}: {a.get('description', '')[:60]}\")\n            return analyzers\n        return []\n\n    def analyze_observable(self, observable_type, observable_value, analyzer_id):\n        \"\"\"Submit an observable for analysis.\"\"\"\n        job = {\n            \"data\": observable_value,\n            \"dataType\": observable_type,\n            \"tlp\": 2,\n            \"message\": \"TIP automated enrichment\",\n        }\n        resp = requests.post(\n            f\"{self.url}\u002Fapi\u002Fanalyzer\u002F{analyzer_id}\u002Frun\",\n            json=job,\n            headers=self.headers,\n            timeout=30,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n\n    def get_job_report(self, job_id):\n        \"\"\"Get the report for a completed analysis job.\"\"\"\n        resp = requests.get(\n            f\"{self.url}\u002Fapi\u002Fjob\u002F{job_id}\u002Freport\",\n            headers=self.headers,\n            timeout=60,\n        )\n        if resp.status_code == 200:\n            return resp.json()\n        return None\n```\n\n### Step 4: Implement Analyst Dashboard Metrics\n\n```python\nclass TIPMetrics:\n    \"\"\"Collect platform metrics for analyst dashboards.\"\"\"\n\n    def __init__(self, misp, opencti):\n        self.misp = misp\n        self.opencti = opencti\n\n    def get_platform_stats(self):\n        \"\"\"Collect statistics across all platform components.\"\"\"\n        stats = {}\n\n        # MISP stats\n        misp_stats = self.misp.get_server_statistics()\n        stats[\"misp\"] = {\n            \"total_events\": misp_stats.get(\"event_count\", 0),\n            \"total_attributes\": misp_stats.get(\"attribute_count\", 0),\n            \"active_feeds\": len([\n                f for f in self.misp.feeds()\n                if f.get(\"Feed\", {}).get(\"enabled\")\n            ]),\n        }\n\n        # OpenCTI stats via GraphQL\n        stats[\"opencti\"] = {\n            \"total_indicators\": self.opencti.indicator.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n            \"total_reports\": self.opencti.report.list(\n                first=0, withPagination=True\n            ).get(\"pagination\", {}).get(\"globalCount\", 0),\n        }\n\n        return stats\n```\n\n## Validation Criteria\n\n- All platform components (MISP, OpenCTI, TheHive, Cortex) deployed and accessible\n- MISP-OpenCTI bidirectional sync operational\n- At least 3 OSINT feeds ingesting data\n- Cortex analyzers configured and returning enrichment results\n- Platform metrics dashboard showing real-time statistics\n- STIX\u002FTAXII export functional for intelligence sharing\n\n## References\n\n- [OpenCTI Documentation](https:\u002F\u002Fdocs.opencti.io\u002F)\n- [MISP Project](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [TheHive Project](https:\u002F\u002Fthehive-project.org\u002F)\n- [Cortex Documentation](https:\u002F\u002Fgithub.com\u002FTheHive-Project\u002FCortex)\n- [MISP-OpenCTI Integration](https:\u002F\u002Fdocs.opencti.io\u002Flatest\u002Fdeployment\u002Fconnectors\u002F)\n",{"name":5,"tags":49,"capec":55,"model":30,"tools":56,"domain":40,"maxTurns":60,"nist_csf":61,"subdomain":36,"description":7},[36,50,51,38,52,42,53,54],"cti","ioc","stix","misp","opencti",[],[57,39,58,59],"Read","Glob","Grep",20,[62,63,64,65],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fintel\u002Fplatforms\u002Fthreat\u002Fhunt","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill platforms-threat-hunt",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill platforms-threat-hunt",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill platforms-threat-hunt","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fplatforms\u002Fthreat\u002Fhunt\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",674,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fplatforms\u002Fthreat\u002Fhunt\u002Findex.json",[94,117,138,159,181,197],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,35,41,106,107,108,109,110,111,112,113,114,115,40,116],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[124,101,125,104,126,127,128,40,39,129,130,131,132,133,35,134,135,34,136,137],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[145,146,147,148,149,150,40,39,151,129,152,153,35,34,154,155,156,157,158,30],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,166,167,168,169,170,171,41,172,40,116,173,174,175,176,177,178,179,180,35],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[188,189,102,190,168,170,191,41,192,172,40,116,129,193,194,195,196,180,35,106],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,102,168,205,191,41,206,207,40,116,208,209,210,211,212,213,35,106,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]