Skip to content
Get packs

Guide · Agent skill

How to use the OpenCTI IOC Enrichment Pipeline agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This page explains the building-ioc-enrichment-pipeline-with-opencti agent skill, a playbook that lets an AI agent help you build an automated enrichment pipeline on OpenCTI, an open-source threat intelligence platform. It is written for security engineers and threat intel teams who may never have used an agent skill before. By the end you will know what the skill does, how to install it, how to ask for help with natural requests, and what to check before running anything.

OpenCTI IOC Enrichment Pipelinemukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the ZIP for building-ioc-enrichment-pipeline-with-opencti from this page.
  2. 2Install the skill. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, upload it under Settings → Capabilities → Skills.
  3. 3Confirm prerequisites. Make sure Docker, Docker Compose, Python 3.9+ with pycti, stix2 and requests, and the OpenCTI backend services are available.
  4. 4Ask for a specific task. Describe the outcome in plain language, naming your platform and the enrichment services you have keys for.
  5. 5Review the output. Read the agent's configuration and code, replace placeholder credentials and check the TLP settings.
  6. 6Test in isolation. Run one connector against a non-production OpenCTI instance and confirm the results before expanding scope.

What is an agent skill and what does this one do?

An agent skill is a folder of instructions, reference notes, templates and scripts that an AI agent can load when a task matches its description. This skill is named building-ioc-enrichment-pipeline-with-opencti and is licensed under Apache-2.0.

Its purpose is to help the agent plan and build an enrichment pipeline on OpenCTI. Enrichment means taking an indicator of compromise (IOC) such as an IP address, domain or file and adding context from outside services. The skill describes using OpenCTI's internal enrichment connectors to pull context from VirusTotal, Shodan, AbuseIPDB and GreyNoise, correlating indicators with known actors and campaigns, and scoring them so analysts see the most urgent ones first.

  • Walk you through deploying OpenCTI with Docker Compose
  • Configure enrichment connectors for IPv4 addresses, domains, URLs and files
  • Outline a custom enrichment connector written in Python with pycti and stix2
  • Help define confidence scoring on a 0-100 scale
  • Provide a report template (assets/template.md) for enrichment results
  • Include bundled Python scripts (scripts/agent.py, scripts/process.py) that can query an OpenCTI instance and call enrichment APIs

Install the skill from the ZIP download

Download the ZIP for this skill from this page. Unzip it so that the folder named building-ioc-enrichment-pipeline-with-opencti, containing SKILL.md, is placed in one of the locations below.

For a personal install, put it in your user skills folder. For a single project, put it in that project's .claude/skills/ folder so it only loads for that project. In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.

  • Personal: ~/.claude/skills/
  • Project: .claude/skills/ inside your project folder
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check what you need before you start

The skill itself is only instructions and scripts. The pipeline it describes needs real infrastructure and accounts. Gather these before asking the agent to build anything.

The skill uses the network, and its scripts can run, so review them before executing them in any environment that holds real data.

  • Docker and Docker Compose
  • Python 3.9+ with the pycti, stix2 and requests libraries
  • An OpenCTI instance backed by Elasticsearch or OpenSearch
  • RabbitMQ or Redis for connector messaging, and MinIO for storage
  • API keys for VirusTotal, Shodan, AbuseIPDB and GreyNoise (accounts required)
pip install pycti

How to trigger the skill with natural requests

You do not need special syntax. Describe the task in plain language that matches the skill's description, such as deploying OpenCTI or automating enrichment of newly ingested indicators. The agent should load the skill when the request fits.

Good requests name the outcome and the constraints. Mention your platform, which enrichment services you have keys for, and whether the data is sensitive.

  • "Using the OpenCTI enrichment skill, plan a Docker Compose deployment for a small team."
  • "Set up VirusTotal and AbuseIPDB enrichment connectors in OpenCTI for IPv4 addresses and domains."
  • "Write a Python enrichment connector that scores new IP observables and labels malicious ones."
  • "Help me design a confidence scoring scheme that prioritises indicators for analysts."

Example: enriching an IP address with GreyNoise

The skill includes a custom connector example. When an IPv4-Addr observable is created, the connector queries the GreyNoise Community API, then creates a Note with the classification, noise and RIOT fields and attaches it to the observable. The example also adds a label when the classification is malicious.

Treat the example as a starting point. Replace the placeholder credentials and review the code before you run it against a live instance.

  • Connector receives the entity_id of a new observable
  • Reads the observable's type and value from OpenCTI
  • Queries an external service and builds a STIX Note
  • Sends the result back to OpenCTI as a bundle

Safety notes before you run anything

Enrichment sends observable values to external APIs. Before enriching, check the TLP marking of each indicator against the data-sharing rules you are bound by. The sample connector configuration uses TLP:AMBER as a maximum for several services, so set these values deliberately.

The bundled scripts and sample configuration contain placeholder credentials, including a default admin password in the docker-compose example. Change every credential before any real deployment. The skill's files were not tested in the form provided, so validate them in a non-production environment first.

  • Replace ChangeMeNow and all token placeholders with secrets from your secret store
  • Do not send unreleased or sensitive indicators to third-party services without approval
  • Review scripts/agent.py and scripts/process.py before running them, since the skill runs scripts and uses the network
  • Confirm each API key's terms allow the lookups you plan to automate

Tips for getting useful results

Ask the agent for one connector at a time and test each in isolation. Use the report template in assets/template.md to record each observable's initial score, enriched score and priority so results are consistent across analysts.

Keep the reference files in mind when you ask detailed questions. references/api-reference.md covers pycti client calls, references/standards.md summarises STIX 2.1 objects, and references/workflows.md holds the workflow notes.

  • Start with IPv4-Addr and Domain-Name connectors before adding file or URL scope
  • Keep your OpenCTI version pinned consistently across all images
  • Ask the agent to explain each STIX object it creates so analysts can follow the data

What people use it for

  • Deploying a test OpenCTI instance with Docker Compose and a set of enrichment connectors
  • Enriching newly created IPv4 addresses with GreyNoise and AbuseIPDB context
  • Adding VirusTotal and Shodan context to domain and file observables
  • Drafting a custom Python enrichment connector that labels malicious indicators
  • Designing a 0-100 confidence scoring approach for analyst triage

Frequently asked questions

Is the OpenCTI IOC enrichment skill free to use?

The skill is licensed under Apache-2.0. The services it connects to, such as VirusTotal, Shodan, AbuseIPDB and GreyNoise, require accounts and API keys, and their pricing and terms are set by those providers. This page does not state their costs.

What do I need to run this OpenCTI enrichment pipeline?

You need Docker and Docker Compose, Python 3.9+ with pycti, stix2 and requests, an OpenCTI instance with Elasticsearch or OpenSearch, RabbitMQ or Redis, and MinIO. You also need API keys for VirusTotal, Shodan, AbuseIPDB and GreyNoise.

How do I install an agent skill like this one?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.

Are the scripts safe to run?

The skill runs scripts and uses the network, and the sample configuration contains placeholder credentials such as a default admin password. Review the code, replace all secrets and test in a non-production environment first.

Will enrichment send my indicators to outside companies?

Yes. Enrichment connectors send observable values to external APIs such as VirusTotal and Shodan. Check the TLP marking and your data-sharing rules before enriching any indicator.

How is this different from setting up OpenCTI connectors by hand?

The skill gives an agent a structured playbook covering deployment, connector configuration, a custom connector example and confidence scoring, so you get a plan and starter code. You still need to deploy the infrastructure, obtain the API keys and validate the results yourself.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security engineers and threat intel teams who already plan to run OpenCTI and want a structured starting point for enrichment and scoring. It is a poor fit for teams without an OpenCTI instance or the capacity to run its backing services, or for anyone who cannot yet verify TLP and data-sharing rules. Treat its scripts and sample configuration as untested drafts that need review before any production use.

Download the skill