Threat Feed Aggregation with MISP
Guides an agent through deploying MISP and wiring threat intelligence feeds into it and your SIEM
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can walk you through setting up MISP, an open-source threat intelligence platform, using Docker. It explains how to enable public threat feeds such as abuse.ch, AlienVault OTX and CIRCL, schedule synchronisation, and connect the results to tools like Splunk, Elasticsearch or SOAR platforms. It also includes a helper Python script that calls the MISP API to list and manage feeds.
Great for
- Security teams standing up a central place to store and share indicators of compromise (IOCs)
- Engineers who need to feed multiple threat intelligence sources into a SIEM
- Students learning how threat intelligence platforms are deployed and configured
Skip it if
- Production use without review: the sample docker-compose file contains placeholder passwords and a default admin passphrase that must be changed, and it exposes ports 80 and 443 publicly, which needs hardening.
- Organisations that cannot send indicator data to third-party feeds or sharing communities, since enabling feeds and sync sends and receives data with external parties.
- Users without Docker, a Linux server with roughly 8GB RAM, or basic familiarity with APIs; the setup is not beginner-friendly.
Try asking
- “Set up a MISP instance with Docker Compose and enable the recommended OSINT feeds”
- “Add a custom CSV threat feed to MISP and trigger a fetch of all enabled feeds”
- “Show me which MISP feeds are enabled and which are disabled”
- “Explain how to connect MISP to Splunk using STIX/TAXII”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
building-threat-feed-aggregation-with-misp.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-threat-feed-aggregation-with-misp.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-threat-feed-aggregation-with-misp.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Change every default password and passphrase in the docker-compose example before deployment, and restrict access to the MISP web interface.
- Review each external feed before enabling it, and check the sharing and distribution settings so you do not publish internal data unintentionally.
- The script disables TLS certificate verification when SKIP_TLS_VERIFY=true; use that only in isolated lab environments and keep verification on in production.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.