How to use the MISP Threat Landscape Analyzer agent skill

What is this agent skill and what does it do?

An agent skill is a folder containing instructions and scripts that an AI agent can load when a task matches the skill's description. This one is for threat intelligence work. MISP is an open-source platform where security teams share threat intelligence, and this skill teaches the agent to connect to a MISP server and pull recent events from a chosen time window.

From those events, the agent computes a structured summary. It counts events by threat level, breaks down indicator types such as IP addresses, domains and hashes, and tallies MITRE ATT&CK techniques, threat actor and malware galaxy clusters, and tag trends over time. The output is meant to support a threat landscape briefing.

• Event counts by threat level
• Attribute type distribution (for example ip-dst, domain, sha256)
• Top MITRE ATT&CK techniques taken from event tags
• Threat actor and malware cluster activity via galaxy clusters
• Temporal trend analysis of IOC submissions

Install the skill from the ZIP or the Claude apps

Download the ZIP for this skill from this page and unzip it. For Claude Code, place the unzipped skill folder in ~/.claude/skills/ to make it available across your projects, or in a project's .claude/skills/ folder to limit it to that project.

In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills. Either way, the skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Install the requirements

The skill needs Python 3.8 or newer, the pymisp Python library, a MISP instance URL, an API key for that instance, and network access to the MISP server. The skill's own setup step installs the library with pip..

• Python 3.8+
• pymisp Python library
• A MISP instance URL and API key
• Network access to the MISP server

Trigger the skill with a natural request

You do not need to name the script. The skill's description tells the agent to use it when you ask to analyze threat intelligence data, summarize top threat actors or malware families, or produce a CTI landscape report from MISP events. Give the agent your MISP URL and key, plus the time window you care about.

Requests that work well describe the output you want. For example: 'Using the MISP threat landscape skill, summarize the last 90 days of events on our MISP server, grouped by threat level, with the top indicator types and top ATT&CK techniques.'

• Summarize the last 90 days of MISP events by threat level and indicator type
• Produce a CTI landscape report from our MISP events for the quarter
• Which threat actors and malware families show up most in MISP this month?

Run the script directly

The skill's instructions show a direct command-line run. It connects to the MISP URL with your key, reads events from the past 90 days, and writes the results to a JSON file. Replace the placeholder URL and key with your own values. The example uses a local address, so use your real server address instead.

The script reads event data and writes it to the file you name, so check the output file location before sharing it.

Read the summary output

The skill's example shows the kind of summary to expect: the period covered, number of events analyzed, the most common threat level, the top attribute types, the top MITRE technique, and the top threat actor. The figures below are an illustration of the format from the skill's example, not results from a real server.

The API reference bundled with the skill documents the fields it reads, including event id, date, threat_level_id, analysis, info, Attribute, Tag and Orgc, and the threat level codes where 1 is High, 2 is Medium, 3 is Low and 4 is Undefined.

• Period: Last 90 days
• Events analyzed: 1,247 (illustrative)
• Top threat level: High (43%) (illustrative)
• Top attribute type: ip-dst (31%), domain (22%), sha256 (18%) (illustrative)
• Top MITRE technique: T1566 Phishing (89 events) (illustrative)
• Top threat actor: APT28 (34 events) (illustrative)

Safety notes before you run it

This skill runs a script and makes network calls to your MISP server. The script reads event data, and the API key grants access to that data, which may include sensitive or restricted intelligence. Treat the key as a credential.

Test on a lab instance or with a least-privilege key first. Confirm the script does what you expect before pointing it at a production server. The skill only analyzes data already in MISP, so it cannot produce findings if your server has no relevant events.

• Use a lab MISP instance or a least-privilege API key for first runs
• Do not paste production keys into shared chats or public repositories
• Review scripts/agent.py before running it against production
• Confirm you are authorized to access the events you analyze