How to use the Collecting Indicators of Compromise agent skill

What the skill makes the agent do

Without the skill, an agent has no fixed process for handling indicators. With it, the agent follows a six-step workflow: identify IOC categories (network, host and email), extract indicators from evidence sources such as SIEM logs, memory dumps and sandbox reports, enrich them with threat intelligence context, score and prioritize them, distribute them to defensive tools, and package them for partners in STIX 2.1 format.

• Network indicators: IPs, domains, URLs, JA3/JA3S hashes, User-Agent strings, DNS query patterns
• Host indicators: file hashes, file paths, registry keys, scheduled tasks and services, mutexes, named pipes
• Email indicators: sender addresses and domains, subject and body patterns, attachment names and hashes, embedded URLs, header failures (SPF/DKIM/DMARC)

Install the skill

Download the ZIP file from this page and unzip it. To make the skill available to all your projects, place the unzipped folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps: open Settings, go to Capabilities, then Skills, and upload the ZIP.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills

Check what you need before running it

The skill's bundled script, scripts/agent.py, needs Python 3 with the requests and stix2 libraries. The reference file lists requests (>=2.28) and stix2 (>=3.0). Enrichment of IP addresses requires a VirusTotal API key, which the script takes as an argument. OTX, Shodan and DomainTools accounts are optional, as are a MISP or TAXII server for sharing.

• Python 3 with requests and stix2
• VirusTotal API key for IP enrichment
• Optional: OTX, Shodan, DomainTools accounts; MISP or TAXII server for sharing

Trigger the skill with natural requests

You do not need to name the skill. Describe the task in plain terms that mention indicators, and the agent should pick it up. The skill's description lists triggers such as IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export and IOC enrichment.

Give the agent the evidence itself, such as a pasted incident report, a log excerpt or a sandbox summary, and say what you want back.

• "Extract the IOCs from this incident report and group them by network, host and email."
• "Enrich these IPs and domains with threat intelligence and give each a confidence score."
• "Package these indicators as a STIX 2.1 bundle for sharing with our partners."

Run the bundled script from the command line

The reference file documents a command-line form of agent.py. It can read a file or a text string, enrich results with VirusTotal, and write the output to a JSON file. The script extracts IPv4 addresses, domains, SHA-256 and MD5 hashes, and URLs using regular expressions, then exports a STIX 2.1 bundle.

Safety notes: scripts and network access

This skill runs scripts and uses the network. The script calls external enrichment services, so the indicators you submit leave your machine and reach those services. Review what you send, and only use API keys you are authorized to use.

Treat the output with care. The skill's own guidance notes that careless distribution can expose an investigation. Check sharing agreements and TLP markings (WHITE, GREEN, AMBER, AMBER+STRICT, RED) before pushing indicators to partners or shared platforms. The skill also recommends defanging malicious URLs and domains in reports, such as evil[.]com.

• Indicators sent to VirusTotal or other services leave your environment
• Check TLP markings and sharing agreements before distribution
• Defang malicious URLs and domains in written reports

Tips for better results

Give the agent full context: the evidence source, the incident type and any known adversary names. The skill's confidence scale runs from 0 to 100, with 90-100 for confirmed malicious indicators seen in an active attack and 0-29 for likely benign or false positives. Ask for that scale explicitly so the scores are easy to act on.

Use the skill for indicator work, not for behavior alone. For behavioral characterization, the skill directs you to MITRE ATT&CK mapping instead.

• Name the evidence type: SIEM logs, memory dump, sandbox report or email
• Ask for the confidence score and TLP label on every indicator
• Expect a STIX 2.1 indicator with a pattern, confidence and labels as in the skill's example