Collecting Threat Intelligence with MISP
Lets an agent set up MISP feeds and script IOC collection, search and export via PyMISP.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
This skill teaches an AI agent how to work with MISP, an open-source platform that stores and shares threat intelligence such as malicious IP addresses, domains, file hashes and URLs. With it installed, the agent can guide you through deploying MISP with Docker, enabling and adding threat feeds, writing Python (PyMISP) code to search events and indicators, and exporting results as STIX, Suricata rules or CSV for other security tools.
Great for
- Security teams building or maintaining a MISP-based threat intelligence pipeline
- Developers who need to script IOC ingestion or export with PyMISP
- Analysts learning how MISP feeds and events are organised
Skip it if
- Users without an existing or planned MISP instance and API key, since most steps depend on one
- Production use without reviewing the scripts first, because they call live feeds and a live MISP server with credentials and can write data
- Non-technical users looking for a finished threat intelligence product; this is a set of instructions and code, not a managed service
Try asking
- “Deploy a MISP instance with Docker and enable the CIRCL OSINT feed”
- “Write a PyMISP script that finds IP indicators flagged for IDS from the last 7 days”
- “Export tlp:white events from MISP as a STIX 2.1 bundle”
- “Add the abuse.ch URLhaus CSV feed to my MISP instance and schedule fetches”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
collecting-threat-intelligence-with-misp.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip collecting-threat-intelligence-with-misp.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip collecting-threat-intelligence-with-misp.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/process.py and scripts/agent.py before running; the example code sets ssl=False in places, so use HTTPS with certificate verification in real deployments.
- Store the MISP API key in an environment variable rather than pasting it into prompts or code.
- Test against a non-production MISP instance first, since feed enabling and fetching change its configuration and data.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.