Guide · Agent skill
How to use the building-threat-intelligence-platform skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the building-threat-intelligence-platform agent skill, a set of instructions and scripts that an AI agent can follow to plan and set up a central threat intelligence platform. It is written for security engineers and SOC leads who want to link MISP, OpenCTI, TheHive and Cortex into one system. By the end you will know how to install the skill, phrase a request that triggers it, what you need before you start, and which parts need hardening before any real use.
Building a Threat Intelligence Platformmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or the project's .claude/skills/ folder for one project. You can also upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 2Check the prerequisites. Confirm Docker, Docker Compose and Python 3.9+ are available, and that you have running or planned MISP, OpenCTI, TheHive and Cortex instances with admin API keys.
- 3Ask for a platform plan. Describe your team and goal in plain language, naming the tools you want to connect. The agent uses SKILL.md to lay out the architecture.
- 4Review the Compose starting point. Read the generated Docker Compose file and replace the example credentials and disabled security settings before any real use.
- 5Configure feeds and connectors. Use the Python examples to enable feeds in MISP and check OpenCTI connector status. Enable only the external feeds your team has agreed to use.
- 6Run the health check. Ask the agent to produce a platform health report using the status template, covering components, feeds, connectors and recommendations.
What the skill makes the agent do
The skill covers designing and deploying a Threat Intelligence Platform (TIP) from open-source CTI tools: MISP, OpenCTI, TheHive and Cortex. The source describes a layered design: a collection layer for feed ingestion, a storage layer on Elasticsearch or OpenSearch, an analysis layer (OpenCTI for knowledge graph analysis and MISP for IOC correlation), an enrichment layer using Cortex analyzers, a response layer in TheHive for case management, and a sharing layer using a TAXII server.
It also describes the integration points: MISP and OpenCTI sync through the OpenCTI MISP connector, OpenCTI can create alerts and cases in TheHive from high-confidence indicators, and TheHive sends observables to Cortex for analysis. Per the source, the skill is aimed at security teams building their own CTI setup, not at people who want threat data.
Install the skill
Download the skill ZIP from this page. Then choose one of the following options.
For a personal setup, unzip the file into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
After unzipping, the skill folder should contain SKILL.md, scripts/agent.py, scripts/process.py, references/ and assets/. SKILL.md is the file that describes the skill to the agent.
- Personal use: ~/.claude/skills/
- Project use: the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Know what you need before you start
The skill assumes working knowledge of security tooling. The source lists these requirements: Docker and Docker Compose; Python 3.9+ with the pymisp, pycti, thehive4py and requests libraries; Elasticsearch or OpenSearch, Redis, RabbitMQ and MinIO (deployed through Compose); API keys for enrichment services such as VirusTotal, Shodan and AbuseIPDB; and running MISP, OpenCTI, TheHive and Cortex instances with admin API keys.
The skill also expects you to understand the STIX 2.1 data model and TAXII 2.1 transport. The feeds it references are external, and you must enable them yourself.
- Docker and Docker Compose
- Python 3.9+ with pymisp, pycti, thehive4py, requests
- Elasticsearch/OpenSearch, Redis, RabbitMQ, MinIO
- Enrichment API keys (VirusTotal, Shodan, AbuseIPDB)
- Running MISP, OpenCTI, TheHive and Cortex with admin API keys
Trigger the skill with a natural request
The skill's description says to use it when you are architecting or standing up a centralized CTI platform to collect, analyze and disseminate threat intelligence across a security team. Ask for that outcome in plain language and name the tools involved. Being specific about your goal helps the agent choose the right steps.
Requests that fit the skill describe building or planning the system, not looking up a specific threat. Examples are given below.
- Help me plan a shared threat intel platform for our SOC using MISP and OpenCTI.
- Design a TIP that links TheHive and Cortex so high-confidence indicators become cases.
- Set up a STIX/TAXII sharing layer for our team's threat intelligence.
- Write a platform health check report for our MISP, OpenCTI and TheHive instances.
What the skill produces
The source says the skill gives you a Docker Compose starting point, Python examples for configuring feeds and connectors, and helper scripts for indicator classification, TLP sharing labels and platform health checks. The assets include a status report template with tables for platform health, feed ingestion status, platform metrics, connector status and recommendations.
The Python examples use PyMISP, pycti and requests. A feed manager example enables OSINT feeds in MISP and lists OpenCTI connectors, and a Cortex example lists analyzers and submits observables with a TLP value.
- Docker Compose starting point for the full stack
- Python feed and connector configuration examples
- Helper scripts: indicator classification, TLP sharing labels, health checks
- Status report template for platform health and feeds
Safety notes before any real deployment
The source is explicit that the sample Compose file is not production-ready. It uses example credentials, disables the Elasticsearch security setting (xpack.security.enabled=false), and exposes plain HTTP service links. Harden these before exposing anything beyond a test environment.
The skill runs scripts and uses the network, and its code calls external enrichment services. Review the scripts in scripts/ before running them, and keep API keys out of shared files. The example PyMISP client also sets ssl=False, which you should change for a real deployment.
- Replace the example admin credentials in the Compose file
- Re-enable Elasticsearch security instead of disabling it
- Move from plain HTTP service links to HTTPS
- Review scripts/agent.py and scripts/process.py before running
- Do not treat the skill as a finished production setup
What people use it for
- Planning a shared CTI platform for a SOC team that links MISP and OpenCTI
- Wiring TheHive and Cortex so that observables are analysed automatically
- Setting up a STIX 2.1 and TAXII 2.1 layer to share indicators with partners
- Producing a platform status report that covers feeds, connectors and recommendations
- Writing integration code that uses PyMISP, pycti and thehive4py
Frequently asked questions
How do I install the building-threat-intelligence-platform skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills instead.
Is this skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. The tools it connects, such as MISP, OpenCTI, TheHive and Cortex, are open source, but you still need to run them yourself and obtain your own API keys for enrichment services.
What do I need to run it?
You need Docker and Docker Compose, Python 3.9+ with pymisp, pycti, thehive4py and requests, and Elasticsearch or OpenSearch, Redis, RabbitMQ and MinIO. You also need running MISP, OpenCTI, TheHive and Cortex instances with admin API keys.
Does the skill provide threat data or feeds?
No. The skill builds the infrastructure only. The feeds it references are external, and you must enable them yourself.
Can I use the Docker Compose file in production?
Not without changes. The source notes that the sample file uses example credentials, disables the Elasticsearch security setting and uses plain HTTP service links. These must be hardened and reviewed first.
How does this compare with using MISP or OpenCTI alone?
MISP and OpenCTI are the tools themselves. This skill helps an agent plan and connect them into one platform with enrichment, case management and sharing. If you only need to read threat reports, this skill is not the right choice.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security engineers and SOC leads who are building a shared CTI platform and are comfortable with Docker, Python and security tooling. It is not suitable for people who only want threat reports, for non-technical users, or for production deployment without a security review of the sample configuration.
Download the skill