How to use the correlating-threat-campaigns agent skill

What the skill makes the agent do

Once installed, the agent follows a five-step workflow: collect and normalise candidate events, look for pivot points, calculate a correlation confidence, build a campaign graph, and produce a campaign intelligence report. Pivot points are checked across four dimensions: infrastructure (shared IP addresses, /24 subnets, registrant details, ASNs, SSL certificate fingerprints), capability (shared malware hashes, YARA matches, C2 protocol parameters, packers), timing (events in the same window, kill-chain sequences, compilation timestamps) and victimology (target sector, geography, technology).

The skill weights these signals. Infrastructure overlap carries the most weight (40), capability overlap is next (35), temporal clustering is 15 and victim alignment is 10. The total is labelled HIGH at 70 or more, MEDIUM at 45 or more, and LOW otherwise. The report the agent drafts covers a campaign name, timeline, suspected actor with confidence, target profile, TTP summary, shared indicators and detection guidance.

Install the skill from the ZIP or the Claude apps

Download the ZIP for this skill from this page and unzip it. For a personal install, place the unzipped skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

The skill folder contains SKILL.md (the instructions the agent reads), scripts/agent.py (a Python helper) and references/api-reference.md (MISP REST API examples).

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside the project
• Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with natural requests

You do not need a special command. The skill description says it activates for requests about campaign analysis, incident clustering, cross-organisational IOC correlation or the MISP correlation engine. Describe what you have and what you want, and include the indicators or event details you are working from.

Good requests name the data and the question. Vague requests like 'look at these' are more likely to produce a generic answer.

• Here are five incidents from the last six months with the same C2 IP range. Are they one campaign? Score the links and draft a report.
• An ISAC partner shared these hashes and domains. Check whether they match our past events in the SIEM export I have attached.
• Cluster these incidents by infrastructure and timing, then tell me which links are weak.
• Build a campaign graph outline for these events and list the shared indicators I can block.

Use the MISP helper and API examples

The bundled helper scripts/agent.py queries a MISP threat-sharing server over its REST API and uses only the Python standard library. Using it needs a MISP instance and an API key. The reference file shows the kinds of calls involved: searching attributes by type and value, searching events by tag and date, viewing an event with its correlations, and adding an attribute to an event. Replace the placeholder URL and key with your own values.

Avoid false attribution and read the scores with care

The skill is explicit that weak signals should not be forced into a campaign. Shared CDN or shared hosting IPs do not establish linkage, and several threat actors use the same tools such as Cobalt Strike. Premature attribution to an actor persists in reports, so treat a HIGH score as a reason to gather more evidence, not as proof.

The confidence snippet in the skill calls helper functions such as count_shared_infra and assess_temporal_clustering. The snippet does not define them, so you or the agent must supply those functions before the score can run.

• Do not treat shared CDN or bulletproof-hosting IPs as proof of linkage.
• Do not attribute a campaign to an actor until the evidence threshold is met.
• Check for recycled infrastructure when incidents are years apart.