[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7A4VN1HHTMAG1ZCKCSTZPJ2":3,"skill-same:01M7A4VN1HHTMAG1ZCKCSTZPJ2":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":14,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M7A4VN1HHTMAG1ZCKCSTZPJ2","building-threat-intelligence-feed-integration",null,"Builds automated threat intelligence feed integration pipelines connecting STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.","NeelakshSaxena\u002FVayu","NeelakshSaxena","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F87892838?v=4","01M7A3B9YFS6F6N9DD1787DT86","Neelaksh Saxena","01M7A3B9ZKBT09MNMPX2XN69BY",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: building-threat-intelligence-feed-integration\ndescription: 'Builds automated threat intelligence feed integration pipelines connecting\n  STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM\n  and security tools for real-time IOC matching and alerting. Use when SOC teams need\n  to operationalize threat intelligence by automating feed ingestion, normalization,\n  scoring, and distribution to detection systems.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- threat-intelligence\n- stix\n- taxii\n- misp\n- feeds\n- ioc\n- siem-integration\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1071\n- T1105\n- T1588.001\n---\n# Building Threat Intelligence Feed Integration\n\n## When to Use\n\nUse this skill when:\n- SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms\n- Multiple TI sources require normalization into a common format (STIX 2.1)\n- Detection systems need real-time IOC matching against network and endpoint telemetry\n- TI feed quality assessment and deduplication processes need to be established\n\n**Do not use** for manual IOC lookup — use dedicated enrichment tools (VirusTotal, AbuseIPDB) for ad-hoc queries.\n\n## Prerequisites\n\n- MISP instance or Threat Intelligence Platform (TIP) for feed aggregation\n- STIX\u002FTAXII client library (`taxii2-client`, `stix2` Python packages)\n- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with TI framework configured\n- API keys for commercial and open-source feeds (AlienVault OTX, Abuse.ch, CISA AIS)\n- Python 3.8+ for feed processing automation\n\n## Workflow\n\n### Step 1: Identify and Catalog Intelligence Sources\n\nMap available feeds by type, format, and update frequency:\n\n| Feed Source | Format | IOC Types | Update Freq | Cost |\n|-------------|--------|-----------|-------------|------|\n| AlienVault OTX | STIX\u002FJSON | IP, Domain, Hash, URL | Real-time | Free |\n| Abuse.ch URLhaus | CSV\u002FJSON | URL, Domain | Every 5 min | Free |\n| Abuse.ch MalwareBazaar | JSON API | File Hash | Real-time | Free |\n| CISA AIS | STIX\u002FTAXII 2.1 | All types | Daily | Free (US Gov) |\n| CrowdStrike Intel | STIX\u002FJSON | All types + Actor TTP | Real-time | Commercial |\n| Mandiant Advantage | STIX 2.1 | All types + Reports | Real-time | Commercial |\n\n### Step 2: Ingest STIX\u002FTAXII Feeds\n\nConnect to a TAXII 2.1 server and download indicators:\n\n```python\nfrom taxii2client.v21 import Server, Collection\nfrom stix2 import parse\n\n# Connect to TAXII server (example: CISA AIS)\nserver = Server(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# List available collections\nfor api_root in server.api_roots:\n    print(f\"API Root: {api_root.title}\")\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a collection\ncollection = Collection(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# Get indicators added in last 24 hours\nfrom datetime import datetime, timedelta\nadded_after = (datetime.utcnow() - timedelta(days=1)).strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n\nresponse = collection.get_objects(added_after=added_after, type=[\"indicator\"])\nfor obj in response.get(\"objects\", []):\n    indicator = parse(obj)\n    print(f\"Type: {indicator.type}\")\n    print(f\"Pattern: {indicator.pattern}\")\n    print(f\"Valid Until: {indicator.valid_until}\")\n    print(f\"Confidence: {indicator.confidence}\")\n    print(\"---\")\n```\n\n### Step 3: Ingest Open-Source Feeds\n\n**Abuse.ch URLhaus Feed:**\n\n```python\nimport requests\nimport csv\nfrom io import StringIO\n\n# Download URLhaus recent URLs\nresponse = requests.get(\"https:\u002F\u002Furlhaus.abuse.ch\u002Fdownloads\u002Fcsv_recent\u002F\")\nreader = csv.reader(StringIO(response.text), delimiter=',')\n\nindicators = []\nfor row in reader:\n    if row[0].startswith(\"#\"):\n        continue\n    indicators.append({\n        \"id\": row[0],\n        \"dateadded\": row[1],\n        \"url\": row[2],\n        \"url_status\": row[3],\n        \"threat\": row[5],\n        \"tags\": row[6]\n    })\n\nprint(f\"Ingested {len(indicators)} URLs from URLhaus\")\n\n# Filter for active threats only\nactive = [i for i in indicators if i[\"url_status\"] == \"online\"]\nprint(f\"Active threats: {len(active)}\")\n```\n\n**AlienVault OTX Pulse Feed:**\n\n```python\nfrom OTXv2 import OTXv2, IndicatorTypes\n\notx = OTXv2(\"YOUR_OTX_API_KEY\")\n\n# Get subscribed pulses (last 24 hours)\npulses = otx.getall(modified_since=\"2024-03-14T00:00:00\")\n\nfor pulse in pulses:\n    print(f\"Pulse: {pulse['name']}\")\n    print(f\"Tags: {pulse['tags']}\")\n    for indicator in pulse[\"indicators\"]:\n        print(f\"  IOC: {indicator['indicator']} ({indicator['type']})\")\n```\n\n**Abuse.ch Feodo Tracker (C2 IPs):**\n\n```python\nresponse = requests.get(\"https:\u002F\u002Ffeodotracker.abuse.ch\u002Fdownloads\u002Fipblocklist_recommended.json\")\nc2_data = response.json()\n\nfor entry in c2_data:\n    print(f\"IP: {entry['ip_address']}:{entry['port']}\")\n    print(f\"Malware: {entry['malware']}\")\n    print(f\"First Seen: {entry['first_seen']}\")\n    print(f\"Last Online: {entry['last_online']}\")\n```\n\n### Step 4: Normalize and Deduplicate\n\nConvert all feeds to STIX 2.1 format for standardization:\n\n```python\nfrom stix2 import Indicator, Bundle\nimport hashlib\n\ndef create_stix_indicator(ioc_value, ioc_type, source, confidence=50):\n    \"\"\"Convert raw IOC to STIX 2.1 indicator\"\"\"\n    pattern_map = {\n        \"ipv4\": f\"[ipv4-addr:value = '{ioc_value}']\",\n        \"domain\": f\"[domain-name:value = '{ioc_value}']\",\n        \"url\": f\"[url:value = '{ioc_value}']\",\n        \"sha256\": f\"[file:hashes.'SHA-256' = '{ioc_value}']\",\n        \"md5\": f\"[file:hashes.MD5 = '{ioc_value}']\",\n    }\n\n    return Indicator(\n        name=f\"{ioc_type}: {ioc_value}\",\n        pattern=pattern_map[ioc_type],\n        pattern_type=\"stix\",\n        valid_from=\"2024-03-15T00:00:00Z\",\n        confidence=confidence,\n        labels=[source],\n        custom_properties={\"x_source_feed\": source}\n    )\n\n# Deduplicate across sources\nseen_iocs = set()\nunique_indicators = []\n\nfor ioc in all_collected_iocs:\n    ioc_hash = hashlib.sha256(f\"{ioc['type']}:{ioc['value']}\".encode()).hexdigest()\n    if ioc_hash not in seen_iocs:\n        seen_iocs.add(ioc_hash)\n        unique_indicators.append(\n            create_stix_indicator(ioc[\"value\"], ioc[\"type\"], ioc[\"source\"])\n        )\n\nbundle = Bundle(objects=unique_indicators)\nprint(f\"Unique indicators: {len(unique_indicators)}\")\n```\n\n### Step 5: Push to SIEM Threat Intelligence Framework\n\n**Push to Splunk ES Threat Intelligence:**\n\n```python\nimport requests\n\nsplunk_url = \"https:\u002F\u002Fsplunk.company.com:8089\"\nheaders = {\"Authorization\": f\"Bearer {splunk_token}\"}\n\nfor indicator in unique_indicators:\n    # Extract IOC value from STIX pattern\n    ioc_value = indicator.pattern.split(\"'\")[1]\n\n    # Upload to Splunk ES threat intel collection\n    data = {\n        \"ip\": ioc_value,\n        \"description\": indicator.name,\n        \"weight\": indicator.confidence \u002F\u002F 10,\n        \"threat_key\": indicator.id,\n        \"source_feed\": indicator.get(\"x_source_feed\", \"unknown\")\n    }\n\n    requests.post(\n        f\"{splunk_url}\u002Fservices\u002Fdata\u002Fthreat_intel\u002Fitem\u002Fip_intel\",\n        headers=headers, data=data,\n        verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n    )\n```\n\n**Push to MISP for centralized management:**\n\n```python\nfrom pymisp import PyMISP, MISPEvent, MISPAttribute\n\nmisp = PyMISP(\"https:\u002F\u002Fmisp.company.com\", \"YOUR_MISP_API_KEY\")\n\n# Create event for feed batch\nevent = MISPEvent()\nevent.info = f\"TI Feed Import - {datetime.now().strftime('%Y-%m-%d')}\"\nevent.threat_level_id = 2  # Medium\nevent.analysis = 2  # Completed\n\n# Add indicators as attributes\nfor ioc in unique_indicators:\n    attr = MISPAttribute()\n    attr.type = \"ip-dst\" if \"ipv4\" in ioc.pattern else \"domain\"\n    attr.value = ioc.pattern.split(\"'\")[1]\n    attr.to_ids = True\n    attr.comment = f\"Source: {ioc.get('x_source_feed', 'mixed')}\"\n    event.add_attribute(**attr)\n\nresult = misp.add_event(event)\nprint(f\"MISP Event created: {result['Event']['id']}\")\n```\n\n### Step 6: Monitor Feed Health and Quality\n\nTrack feed effectiveness metrics:\n\n```spl\nindex=threat_intel sourcetype=\"threat_intel_manager\"\n| stats count AS total_iocs,\n        dc(threat_key) AS unique_iocs,\n        dc(source_feed) AS feed_count\n  by source_feed\n| join source_feed [\n    search index=notable source=\"Threat Intelligence\"\n    | stats count AS matches by source_feed\n  ]\n| eval match_rate = round(matches \u002F unique_iocs * 100, 2)\n| sort - match_rate\n| table source_feed, unique_iocs, matches, match_rate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — standardized JSON format for sharing threat intelligence objects |\n| **TAXII** | Trusted Automated eXchange of Indicator Information — transport protocol for sharing STIX data via REST API |\n| **TIP** | Threat Intelligence Platform — centralized system for aggregating, scoring, and distributing threat intelligence |\n| **IOC Scoring** | Process of assigning confidence values to indicators based on source reliability and corroboration |\n| **Feed Deduplication** | Removing duplicate IOCs across multiple sources while preserving multi-source attribution |\n| **IOC Expiration** | Time-to-live policy removing aged indicators (IP: 30 days, Domain: 90 days, Hash: 1 year) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence platform for feed aggregation, correlation, and sharing\n- **AlienVault OTX**: Free threat intelligence sharing platform with community pulse feeds\n- **Abuse.ch**: Suite of free threat feeds (URLhaus, MalwareBazaar, Feodo Tracker, ThreatFox)\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 native storage\n- **TAXII2 Client**: Python library for connecting to STIX\u002FTAXII 2.1 servers for automated indicator retrieval\n\n## Common Scenarios\n\n- **New Feed Onboarding**: Evaluate feed quality, map fields to STIX, configure automated ingestion pipeline\n- **Multi-SIEM Distribution**: Push normalized IOCs from MISP to Splunk, Elastic, and Sentinel simultaneously\n- **False Positive Reduction**: Score IOCs by source count and age, expire stale indicators automatically\n- **Feed Quality Audit**: Compare detection match rates across feeds to identify highest-value sources\n- **Incident IOC Sharing**: Package investigation IOCs as STIX bundle and share with ISACs via TAXII\n\n## Output Format\n\n```\nTHREAT INTEL FEED STATUS — Daily Report\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-15\nTotal IOCs:   45,892 active indicators\n\nFeed Health:\n  Feed                  IOCs    Matches  Match Rate  Status\n  Abuse.ch URLhaus      12,340  47       0.38%       HEALTHY\n  AlienVault OTX        18,567  23       0.12%       HEALTHY\n  Abuse.ch Feodo        1,203   12       1.00%       HEALTHY\n  CISA AIS              8,945   8        0.09%       HEALTHY\n  CrowdStrike Intel     4,837   31       0.64%       HEALTHY\n\nActions Today:\n  New IOCs ingested:    1,247\n  IOCs expired:         892\n  Duplicates removed:   156\n  SIEM matches:         121 notable events generated\n  False positives:      3 (CDN IPs removed from feed)\n```\n","# Building Threat Intelligence Feed Integration\n\n## When to Use\n\nUse this skill when:\n- SOC teams need automated ingestion of threat intelligence feeds into SIEM platforms\n- Multiple TI sources require normalization into a common format (STIX 2.1)\n- Detection systems need real-time IOC matching against network and endpoint telemetry\n- TI feed quality assessment and deduplication processes need to be established\n\n**Do not use** for manual IOC lookup — use dedicated enrichment tools (VirusTotal, AbuseIPDB) for ad-hoc queries.\n\n## Prerequisites\n\n- MISP instance or Threat Intelligence Platform (TIP) for feed aggregation\n- STIX\u002FTAXII client library (`taxii2-client`, `stix2` Python packages)\n- SIEM platform (Splunk ES, Elastic Security, or Sentinel) with TI framework configured\n- API keys for commercial and open-source feeds (AlienVault OTX, Abuse.ch, CISA AIS)\n- Python 3.8+ for feed processing automation\n\n## Workflow\n\n### Step 1: Identify and Catalog Intelligence Sources\n\nMap available feeds by type, format, and update frequency:\n\n| Feed Source | Format | IOC Types | Update Freq | Cost |\n|-------------|--------|-----------|-------------|------|\n| AlienVault OTX | STIX\u002FJSON | IP, Domain, Hash, URL | Real-time | Free |\n| Abuse.ch URLhaus | CSV\u002FJSON | URL, Domain | Every 5 min | Free |\n| Abuse.ch MalwareBazaar | JSON API | File Hash | Real-time | Free |\n| CISA AIS | STIX\u002FTAXII 2.1 | All types | Daily | Free (US Gov) |\n| CrowdStrike Intel | STIX\u002FJSON | All types + Actor TTP | Real-time | Commercial |\n| Mandiant Advantage | STIX 2.1 | All types + Reports | Real-time | Commercial |\n\n### Step 2: Ingest STIX\u002FTAXII Feeds\n\nConnect to a TAXII 2.1 server and download indicators:\n\n```python\nfrom taxii2client.v21 import Server, Collection\nfrom stix2 import parse\n\n# Connect to TAXII server (example: CISA AIS)\nserver = Server(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# List available collections\nfor api_root in server.api_roots:\n    print(f\"API Root: {api_root.title}\")\n    for collection in api_root.collections:\n        print(f\"  Collection: {collection.title} (ID: {collection.id})\")\n\n# Fetch indicators from a collection\ncollection = Collection(\n    \"https:\u002F\u002Ftaxii.cisa.gov\u002Ftaxii2\u002Fcollections\u002FCOLLECTION_ID\u002F\",\n    user=\"your_username\",\n    password=\"your_password\"\n)\n\n# Get indicators added in last 24 hours\nfrom datetime import datetime, timedelta\nadded_after = (datetime.utcnow() - timedelta(days=1)).strftime(\"%Y-%m-%dT%H:%M:%S.000Z\")\n\nresponse = collection.get_objects(added_after=added_after, type=[\"indicator\"])\nfor obj in response.get(\"objects\", []):\n    indicator = parse(obj)\n    print(f\"Type: {indicator.type}\")\n    print(f\"Pattern: {indicator.pattern}\")\n    print(f\"Valid Until: {indicator.valid_until}\")\n    print(f\"Confidence: {indicator.confidence}\")\n    print(\"---\")\n```\n\n### Step 3: Ingest Open-Source Feeds\n\n**Abuse.ch URLhaus Feed:**\n\n```python\nimport requests\nimport csv\nfrom io import StringIO\n\n# Download URLhaus recent URLs\nresponse = requests.get(\"https:\u002F\u002Furlhaus.abuse.ch\u002Fdownloads\u002Fcsv_recent\u002F\")\nreader = csv.reader(StringIO(response.text), delimiter=',')\n\nindicators = []\nfor row in reader:\n    if row[0].startswith(\"#\"):\n        continue\n    indicators.append({\n        \"id\": row[0],\n        \"dateadded\": row[1],\n        \"url\": row[2],\n        \"url_status\": row[3],\n        \"threat\": row[5],\n        \"tags\": row[6]\n    })\n\nprint(f\"Ingested {len(indicators)} URLs from URLhaus\")\n\n# Filter for active threats only\nactive = [i for i in indicators if i[\"url_status\"] == \"online\"]\nprint(f\"Active threats: {len(active)}\")\n```\n\n**AlienVault OTX Pulse Feed:**\n\n```python\nfrom OTXv2 import OTXv2, IndicatorTypes\n\notx = OTXv2(\"YOUR_OTX_API_KEY\")\n\n# Get subscribed pulses (last 24 hours)\npulses = otx.getall(modified_since=\"2024-03-14T00:00:00\")\n\nfor pulse in pulses:\n    print(f\"Pulse: {pulse['name']}\")\n    print(f\"Tags: {pulse['tags']}\")\n    for indicator in pulse[\"indicators\"]:\n        print(f\"  IOC: {indicator['indicator']} ({indicator['type']})\")\n```\n\n**Abuse.ch Feodo Tracker (C2 IPs):**\n\n```python\nresponse = requests.get(\"https:\u002F\u002Ffeodotracker.abuse.ch\u002Fdownloads\u002Fipblocklist_recommended.json\")\nc2_data = response.json()\n\nfor entry in c2_data:\n    print(f\"IP: {entry['ip_address']}:{entry['port']}\")\n    print(f\"Malware: {entry['malware']}\")\n    print(f\"First Seen: {entry['first_seen']}\")\n    print(f\"Last Online: {entry['last_online']}\")\n```\n\n### Step 4: Normalize and Deduplicate\n\nConvert all feeds to STIX 2.1 format for standardization:\n\n```python\nfrom stix2 import Indicator, Bundle\nimport hashlib\n\ndef create_stix_indicator(ioc_value, ioc_type, source, confidence=50):\n    \"\"\"Convert raw IOC to STIX 2.1 indicator\"\"\"\n    pattern_map = {\n        \"ipv4\": f\"[ipv4-addr:value = '{ioc_value}']\",\n        \"domain\": f\"[domain-name:value = '{ioc_value}']\",\n        \"url\": f\"[url:value = '{ioc_value}']\",\n        \"sha256\": f\"[file:hashes.'SHA-256' = '{ioc_value}']\",\n        \"md5\": f\"[file:hashes.MD5 = '{ioc_value}']\",\n    }\n\n    return Indicator(\n        name=f\"{ioc_type}: {ioc_value}\",\n        pattern=pattern_map[ioc_type],\n        pattern_type=\"stix\",\n        valid_from=\"2024-03-15T00:00:00Z\",\n        confidence=confidence,\n        labels=[source],\n        custom_properties={\"x_source_feed\": source}\n    )\n\n# Deduplicate across sources\nseen_iocs = set()\nunique_indicators = []\n\nfor ioc in all_collected_iocs:\n    ioc_hash = hashlib.sha256(f\"{ioc['type']}:{ioc['value']}\".encode()).hexdigest()\n    if ioc_hash not in seen_iocs:\n        seen_iocs.add(ioc_hash)\n        unique_indicators.append(\n            create_stix_indicator(ioc[\"value\"], ioc[\"type\"], ioc[\"source\"])\n        )\n\nbundle = Bundle(objects=unique_indicators)\nprint(f\"Unique indicators: {len(unique_indicators)}\")\n```\n\n### Step 5: Push to SIEM Threat Intelligence Framework\n\n**Push to Splunk ES Threat Intelligence:**\n\n```python\nimport requests\n\nsplunk_url = \"https:\u002F\u002Fsplunk.company.com:8089\"\nheaders = {\"Authorization\": f\"Bearer {splunk_token}\"}\n\nfor indicator in unique_indicators:\n    # Extract IOC value from STIX pattern\n    ioc_value = indicator.pattern.split(\"'\")[1]\n\n    # Upload to Splunk ES threat intel collection\n    data = {\n        \"ip\": ioc_value,\n        \"description\": indicator.name,\n        \"weight\": indicator.confidence \u002F\u002F 10,\n        \"threat_key\": indicator.id,\n        \"source_feed\": indicator.get(\"x_source_feed\", \"unknown\")\n    }\n\n    requests.post(\n        f\"{splunk_url}\u002Fservices\u002Fdata\u002Fthreat_intel\u002Fitem\u002Fip_intel\",\n        headers=headers, data=data,\n        verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n    )\n```\n\n**Push to MISP for centralized management:**\n\n```python\nfrom pymisp import PyMISP, MISPEvent, MISPAttribute\n\nmisp = PyMISP(\"https:\u002F\u002Fmisp.company.com\", \"YOUR_MISP_API_KEY\")\n\n# Create event for feed batch\nevent = MISPEvent()\nevent.info = f\"TI Feed Import - {datetime.now().strftime('%Y-%m-%d')}\"\nevent.threat_level_id = 2  # Medium\nevent.analysis = 2  # Completed\n\n# Add indicators as attributes\nfor ioc in unique_indicators:\n    attr = MISPAttribute()\n    attr.type = \"ip-dst\" if \"ipv4\" in ioc.pattern else \"domain\"\n    attr.value = ioc.pattern.split(\"'\")[1]\n    attr.to_ids = True\n    attr.comment = f\"Source: {ioc.get('x_source_feed', 'mixed')}\"\n    event.add_attribute(**attr)\n\nresult = misp.add_event(event)\nprint(f\"MISP Event created: {result['Event']['id']}\")\n```\n\n### Step 6: Monitor Feed Health and Quality\n\nTrack feed effectiveness metrics:\n\n```spl\nindex=threat_intel sourcetype=\"threat_intel_manager\"\n| stats count AS total_iocs,\n        dc(threat_key) AS unique_iocs,\n        dc(source_feed) AS feed_count\n  by source_feed\n| join source_feed [\n    search index=notable source=\"Threat Intelligence\"\n    | stats count AS matches by source_feed\n  ]\n| eval match_rate = round(matches \u002F unique_iocs * 100, 2)\n| sort - match_rate\n| table source_feed, unique_iocs, matches, match_rate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — standardized JSON format for sharing threat intelligence objects |\n| **TAXII** | Trusted Automated eXchange of Indicator Information — transport protocol for sharing STIX data via REST API |\n| **TIP** | Threat Intelligence Platform — centralized system for aggregating, scoring, and distributing threat intelligence |\n| **IOC Scoring** | Process of assigning confidence values to indicators based on source reliability and corroboration |\n| **Feed Deduplication** | Removing duplicate IOCs across multiple sources while preserving multi-source attribution |\n| **IOC Expiration** | Time-to-live policy removing aged indicators (IP: 30 days, Domain: 90 days, Hash: 1 year) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence platform for feed aggregation, correlation, and sharing\n- **AlienVault OTX**: Free threat intelligence sharing platform with community pulse feeds\n- **Abuse.ch**: Suite of free threat feeds (URLhaus, MalwareBazaar, Feodo Tracker, ThreatFox)\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 native storage\n- **TAXII2 Client**: Python library for connecting to STIX\u002FTAXII 2.1 servers for automated indicator retrieval\n\n## Common Scenarios\n\n- **New Feed Onboarding**: Evaluate feed quality, map fields to STIX, configure automated ingestion pipeline\n- **Multi-SIEM Distribution**: Push normalized IOCs from MISP to Splunk, Elastic, and Sentinel simultaneously\n- **False Positive Reduction**: Score IOCs by source count and age, expire stale indicators automatically\n- **Feed Quality Audit**: Compare detection match rates across feeds to identify highest-value sources\n- **Incident IOC Sharing**: Package investigation IOCs as STIX bundle and share with ISACs via TAXII\n\n## Output Format\n\n```\nTHREAT INTEL FEED STATUS — Daily Report\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDate:         2024-03-15\nTotal IOCs:   45,892 active indicators\n\nFeed Health:\n  Feed                  IOCs    Matches  Match Rate  Status\n  Abuse.ch URLhaus      12,340  47       0.38%       HEALTHY\n  AlienVault OTX        18,567  23       0.12%       HEALTHY\n  Abuse.ch Feodo        1,203   12       1.00%       HEALTHY\n  CISA AIS              8,945   8        0.09%       HEALTHY\n  CrowdStrike Intel     4,837   31       0.64%       HEALTHY\n\nActions Today:\n  New IOCs ingested:    1,247\n  IOCs expired:         892\n  Duplicates removed:   156\n  SIEM matches:         121 notable events generated\n  False positives:      3 (CDN IPs removed from feed)\n```\n",{"name":5,"tags":25,"author":34,"domain":35,"license":15,"version":36,"nist_csf":37,"subdomain":42,"description":43,"mitre_attack":44},[26,27,28,29,30,31,32,33],"soc","threat-intelligence","stix","taxii","misp","feeds","ioc","siem-integration","mahipal","cybersecurity","1.0",[38,39,40,41],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Builds automated threat intelligence feed integration pipelines connecting STIX\u002FTAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.\n",[45,46,47],"T1071","T1105","T1588.001","main","7540bbccf0c1ded6156a467b02c95b61ad62413f",".agents\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena","Currently exploring the intersection of tech","2026-09-11 03:02:31",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add NeelakshSaxena\u002FVayu --skill building-threat-intelligence-feed-integration",{"tool":61,"command":62},"bunx","bunx skills add NeelakshSaxena\u002FVayu --skill building-threat-intelligence-feed-integration",{"tool":64,"command":65},"pnpm","pnpm dlx skills add NeelakshSaxena\u002FVayu --skill building-threat-intelligence-feed-integration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002FSKILL.md",true,[69,73,79],{"path":70,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fapi-reference.md","REFERENCE","参考文档",2187,"https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002Freferences\u002Fapi-reference.md",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"scripts\u002Fagent.py","SCRIPT","脚本",6391,"https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fbuilding-threat-intelligence-feed-integration\u002Fscripts\u002Fagent.py",[86,93,100,107,114,121],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":20},"01M7ACCCVNCFKMA9X6D15X6G98","runpodctl","Runpod CLI for managing GPU\u002FCPU workloads from the terminal — pods, serverless endpoints, templates, network volumes, Hub deploys, models, SSH, and file transfer (send\u002Freceive). Use for terminal\u002FCI\u002Fscripting, Hub browse\u002Fdeploy, SSH setup, `doctor`, or when the Runpod MCP tools are not connected. For structured tool calls in an MCP-enabled session, prefer runpod-mcp.","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Frunpodctl\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":20},"01M7ACC63SRHEA5KMCHSMZK2TC","runpod","Start here for any Runpod task — running GPU\u002FCPU pods, deploying serverless endpoints, templates, network volumes, building images, or understanding how Runpod works. Routes to the right skill (runpod-mcp, runpodctl, flash, companion-clis, runpod-usage, runpod-templates, runpod-migrate) and indexes two dozen live-verified end-to-end examples (golden paths) — use it when the lane is unclear, and for any multi-step or provisioning task even when it is not.","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Frunpod\u002FSKILL.md",[],[],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":20},"01M7ACC0Q1C89N9BZBV91CTQTF","runpod-usage","How Runpod works and how to work it — pods vs serverless, GPU\u002FVRAM selection, storage, building a container, networking, plus the agentic pod development loop (provision → ssh-exec → set up → poll readiness) and on-pod install hygiene (uv\u002Fapt). Use to answer \"how does X work\", \"which GPU\", \"how do I build a container\", or \"how do I stand up a workload on a pod\". Guidance, not a tool — execute with runpodctl, runpod-mcp, or flash.","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Frunpod-usage\u002FSKILL.md",[],[],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M7ACBRPE345GF5GM5B8P8RRC","runpod-templates","Runpod's official prebuilt pod templates (ComfyUI, PyTorch, and others): what each image ships, which ports and paths it uses, how to pick one, how to pin a version, and what is missing on first boot. Use when a task says \"run \u003CX> on a pod\" and an official template already covers it, instead of building an image — and when a user needs help with or wants to fix something about a Runpod template they are already running (won't boot, can't reach the UI, missing models, wrong CUDA line, broken ComfyUI workflow metadata on imported workflows): start here and route onward. Deploy with runpodctl or runpod-mcp; end-to-end walkthroughs live in the runpod router's golden paths.","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Frunpod-templates\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":20},"01M7ACBJATHKVX1TWES2F44GY8","runpod-migrate","Migrate a codebase from the Runpod GraphQL API or REST v1 to REST v2 — inventory which parts use which API version, rewrite the call sites, flag breaking changes, and verify. Use when someone asks to move to v2, asks what v2 would change, or asks which Runpod API their code is on. For managing infrastructure rather than migrating code, use runpod-mcp or runpodctl.","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Frunpod-migrate\u002FSKILL.md",[],[],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":20},"01M7ACBC7GHVH6T9YEAPCG2AP8","runpod-mcp","Manage Runpod infrastructure — pods, serverless endpoints, jobs, templates, network volumes, container-registry auth, GPU\u002FCPU catalog, and billing — via the Runpod MCP server's structured tool calls. Use when the Runpod MCP tools (create-pod, list-endpoints, …) are connected in this session, or to connect them (hosted OAuth or local npx). Prefer this over runpodctl for plain infra CRUD when MCP is available; use runpodctl for the terminal, file transfer, or SSH setup.","https:\u002F\u002Fgithub.com\u002FNeelakshSaxena\u002FVayu\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Frunpod-mcp\u002FSKILL.md",[],[]]