How to use the Automated IOC Enrichment agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file and optional scripts and reference files. When a request matches the skill's description, the agent loads its instructions and follows them. This skill is focused on incident triage: it guides the agent through designing an enrichment workflow, writing Python enrichment functions, building SOAR playbooks, and handling API rate limits and errors.

The skill's own guidance is that enrichment should inform human decisions rather than trigger automatic blocks, because enrichment scores can be wrong.

• Classifies each IOC by type and routes it to the matching lookups
• Queries services such as VirusTotal, AbuseIPDB, Shodan and MISP
• Combines results into a single composite confidence score
• Writes enrichment results to the alert so the analyst sees them first

Install the skill from the ZIP or the Claude apps

Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the skill through the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the ZIP there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Apps: Settings, then Capabilities, then Skills

Check what you need before you start

The skill assumes you already have API access. Most of the workflow depends on keys for threat intelligence services, and the free VirusTotal tier is rate limited to about 4 requests per minute. Without those keys, the lookups in the example code will not return data.

The skill's Python examples use the requests and stix2 libraries and need Python 3.9 or newer. A SOAR platform is optional: the skill mentions Cortex XSOAR, Splunk SOAR, Tines and n8n.

• Python 3.9+ with requests and stix2 installed
• VirusTotal API key (free tier is about 4 requests per minute)
• AbuseIPDB API key
• Shodan API key
• At least one threat intelligence platform such as MISP or OpenCTI
• Optional: a SOAR platform such as Cortex XSOAR, Splunk SOAR, Tines or n8n

Trigger the skill with natural requests

You do not need to name the skill. Describe the task in plain terms that mention enrichment, IOCs, SOAR or the tools involved. The skill's description lists triggers such as SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines and automated IOC processing.

Be specific about the input and the output you want. Naming the IOC types and the sources to check gives the agent what it needs to write useful code.

• Write a Python function that enriches an IP address using VirusTotal, AbuseIPDB and Shodan.
• Design a Cortex XSOAR playbook that enriches SIEM alerts with VirusTotal and MISP data before analysts see them.
• Help me bulk-enrich IOCs from a phishing email submission queue and score each one.
• Plan rate limiting for a pipeline that calls the VirusTotal free tier.

Use the enrichment functions and scoring

The skill's example code defines an EnrichmentResult record and enrichment functions for IPs and file hashes. The IP function queries VirusTotal and AbuseIPDB and computes a composite score: VirusTotal's malicious ratio contributes up to 60 points and the AbuseIPDB confidence contributes up to 40, capped at 100.

The example shows a Shodan key as a parameter of the IP function, but the code shown does not call Shodan. Check the function body before you rely on Shodan data. The skill's guidance is to treat the score as one input to a human decision.

• Signature: enrich_ip(ip, vt_key, abuse_key, shodan_key)
• Hash lookups use VirusTotal files and return a score based on the malicious ratio
• Requests are spaced by a short delay to respect the free-tier limit

Build a SOAR playbook and handle rate limits

For SOAR use, the skill describes a Cortex XSOAR playbook: a SIEM alert triggers the flow, IOCs are extracted with regex, lookups run in parallel, a Python task computes the score, and results are written to the alert context. The skill's example routes scores of 70 or more to a high priority queue, 40 to 69 to a medium queue, and below 40 to auto-close with a note.

Review that last routing rule before you use it. Automatically closing low-scoring alerts is a decision that a person should check, since the skill itself warns that scores can be wrong.

For failures, the skill includes a rate-limit decorator and a retry wrapper for HTTP 429 responses that waits for the Retry-After header. As written, the retry wrapper does not return a response after its final attempt, so add that handling before using it.

• Trigger: alert created in the SIEM, by webhook or polling
• Extract IOCs with regex, then run enrichment tasks in parallel
• Track latency, API success rate, analyst overrides and API call volume