Skip to content
Get packs

Guide · Agent skill

How to use the MISP threat intelligence agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This is an agent skill, a folder of instructions, reference notes, templates and Python scripts that an AI coding agent can load when a task matches it. The skill covers MISP, an open-source platform for storing and sharing threat intelligence such as malicious IP addresses, domains, file hashes and URLs. After reading this guide you will know what the skill lets the agent do, how to install it, how to ask for it in plain language, and what you need before running any of its code.

Collecting Threat Intelligence with MISPmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or into a project's .claude/skills/ folder.
  2. 2Or upload it in the Claude apps. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload the skill.
  3. 3Prepare MISP and credentials. Confirm you have a MISP URL and API key, and install Python 3.9+ with pymisp. Set the key in an environment variable.
  4. 4Ask for the task in plain language. Describe what you want, such as deploying MISP or writing a PyMISP search, and include your MISP URL but not your key.
  5. 5Review the scripts before running. Read scripts/agent.py and scripts/process.py, then run them first against a test MISP instance.

What does this skill make the agent do?

With the skill loaded, the agent can guide you through deploying MISP with Docker, enabling and adding threat feeds, and writing Python code that uses the PyMISP library to search events and indicators of compromise (IOCs). The source describes four feed types: native MISP feeds (such as CIRCL OSINT and botvrij.eu), freetext feeds, TAXII 2.1 feeds, and CSV feeds with configurable column mapping.

The skill also covers exporting results for other tools, including STIX 2.1 bundles, Suricata rules and CSV for SIEM ingestion.

How do you install the skill?

Download the skill ZIP from the page you are reading. Then use one of these two options.

For Claude Code, unzip the folder into ~/.claude/skills/ to make it available in all your projects, or into a project's .claude/skills/ folder to limit it to that project.

In the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

  • Personal install: ~/.claude/skills/
  • Project install: .claude/skills/ inside your project folder
  • Claude apps: Settings → Capabilities → Skills

How do you trigger the skill with natural requests?

You do not need to name the skill. Describe the task, and the agent should load it when the request matches the skill's description, which covers gathering, storing or correlating IOCs, and scripting MISP ingestion with PyMISP.

Requests that fit well include the examples below. Be specific about your MISP URL and what you want back, and never paste a live API key into a chat.

  • Help me deploy MISP with Docker and enable the CIRCL OSINT feed.
  • Write a PyMISP script that pulls IP addresses flagged for IDS from the last 7 days.
  • Add the URLhaus recent CSV as a custom feed in MISP.
  • Export IDS-flagged domains and URLs from MISP as Suricata rules.

What do you need before you start?

Most steps depend on an existing or planned MISP instance and an API key. The skill expects Python 3.9 or newer with the pymisp library, plus stix2 and requests for the bundled process.py script. Deploying MISP requires Docker and Docker Compose, and feed collection needs network access to sources such as circl.lu, botvrij.eu and urlhaus.abuse.ch.

The source's own examples use ssl=False and a placeholder URL. The API reference shows ssl=True and reading the key from an environment variable, which is the safer pattern. Install with pip install pymisp as shown in the API reference.

  • Python 3.9+ with pymisp (and stix2 and requests for process.py)
  • Docker and Docker Compose to deploy MISP
  • A MISP instance URL and API key
  • Network access to external feeds
pip install pymisp export MISP_API_KEY=... # keep the key out of your scripts

What should you check for safety?

This skill runs scripts and uses the network. The scripts call live feeds and a live MISP server with credentials, and they can write data to that server. Read scripts/agent.py and scripts/process.py before running them, and test against a non-production MISP instance first.

Feeds you enable will pull data from external hosts, so only enable feeds you have reviewed. The skill's validation list includes checks such as HTTPS access and scheduled feed fetches, which you should confirm on your own setup.

  • Review scripts/agent.py and scripts/process.py before running.
  • Test on a non-production MISP instance.
  • Store the API key in an environment variable, not in code.
  • Only enable feeds you trust, since they fetch from external hosts.

What tips help you get the most from it?

Start with the reference files the skill includes: workflows.md, api-reference.md and standards.md. Ask the agent to follow the workflow in order, since each step, from deployment to feed setup to search, depends on the one before it.

For reporting, the skill includes assets/template.md, a collection report template with fields for collection statistics and feed status. Use it to record what each run collected.

  • Ask the agent to follow the steps in workflows.md in order.
  • Use the template in assets/template.md to record each collection run.
  • Filter by to_ids and tags to keep noisy indicators out of exports.

What people use it for

  • Deploy a MISP instance with Docker and enable the CIRCL OSINT feed for a security team.
  • Write a PyMISP script that searches recent events for IDS-flagged IP addresses.
  • Export IDS-flagged indicators as Suricata rules for a network sensor.
  • Produce a daily collection report using the included template and feed status table.

Frequently asked questions

How do I install the collecting-threat-intelligence-with-misp skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. In the Claude apps, upload it under Settings, then Capabilities, then Skills.

What do I need to run it?

You need Python 3.9 or newer with pymisp, plus stix2 and requests for process.py. Deploying MISP needs Docker and Docker Compose, and you need a MISP URL and API key. Feed collection also needs network access to the external sources.

Is this skill free to use?

The skill is licensed under Apache-2.0, as listed on this page. MISP itself is an open-source platform. This page does not state pricing for any paid feed or service it may reference.

Can I use it without a MISP instance?

Not really. The source says most steps depend on an existing or planned MISP instance and an API key, so the skill is not useful on its own without one.

How does it compare with other threat intelligence tools?

This page does not include a comparison with other products. The skill is a set of instructions and code for working with MISP. It is not a managed threat intelligence service, so if you want a finished product, look elsewhere.

Why does my PyMISP script fail to connect?

Check that the MISP URL is correct and reachable, and that your API key is valid. The source's examples use ssl=False, so for a production server use HTTPS with ssl=True as shown in the API reference.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security teams and developers who already run or plan to run MISP and want help with feeds, PyMISP scripts and exports. It is not suited to users without a MISP instance and API key, to anyone running the scripts in production without reviewing them, or to people who want a finished threat intelligence product.

Download the skill