Guide · Agent skill
How to use the Splunk Threat Intel Enrichment agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the Splunk Threat Intel Enrichment agent skill does, how to install it, and how to ask an agent to use it. It is written for SOC engineers and security analysts who want help building IOC enrichment in Splunk Enterprise Security. By the end you will know what the skill covers, what your environment needs, and what to review before running anything it produces.
Splunk Threat Intel Enrichmentmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Confirm prerequisites. Check that you have Splunk Enterprise Security 7.x or later, the Threat Intelligence Framework, KV Store enabled and admin access for modular inputs.
- 2Get API keys. Obtain keys for the feeds you plan to use, such as OTX, MISP, VirusTotal or AbuseIPDB, and store them securely.
- 3Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or into .claude/skills/ inside your project.
- 4Ask the agent for a specific build. Describe the feed, indicator type and data source you want, using the threat intel and correlation search language in the skill description.
- 5Review the generated configs and searches. Read the collections.conf, transforms.conf, inputs.conf and SPL the agent produces, and check every field and lookup name against your environment.
- 6Test in a lab. Run the ingestion and correlation searches in a non-production Splunk instance and confirm matches before moving anything to production.
What the skill makes the agent do
The skill gives an agent guidance for setting up threat intelligence in Splunk Enterprise Security. It covers pulling indicators of compromise (IOCs) such as bad IP addresses, domains and file hashes from threat feeds into KV Store lookup collections. Its source material names STIX/TAXII feeds, CSV lists, OTX, MISP and VirusTotal as feed types.
Once the collections exist, the agent can write Splunk search language (SPL) queries that check network and security logs against those indicators, so analysts see matches sooner. The skill also includes Python helper scripts for normalizing indicators, expiring old ones and fetching OTX pulse data.
- Feed ingestion through modular inputs and inputs.conf stanzas
- KV Store collections such as ip_threat_intel, domain_threat_intel and file_hash_intel
- Lookup definitions in transforms.conf
- Correlation searches that flag IOC matches against network traffic and DNS events
How to install the skill
Download the ZIP file from this page. Then unzip it into one of two locations: ~/.claude/skills/ to make the skill available across your projects, or the .claude/skills/ folder inside a single project to limit it to that project.
If you use the Claude apps instead, you can upload the skill there under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload the skill
How to trigger the skill with natural requests
You do not need a special command. The skill's description says to use it when you are wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time, so ask in that kind of language. Name the feed, the indicator type and the data you want to check.
Good requests state the outcome you want. Include the environment details the agent will need, such as which feed you use and which data model your events live in.
- Help me set up a KV Store collection for IP indicators from our MISP feed in Splunk ES.
- Write a correlation search that flags outbound connections to IPs in my threat intel lookup.
- Create a lookup definition for file hash IOCs and a search that matches them against endpoint events.
- Show me how to ingest an OTX pulse feed into Splunk with a modular input.
Example: an IP-matching correlation search
The skill's source includes a worked example that uses the tstats command on the Network_Traffic data model. It summarizes allowed connections, looks up the destination IP in the ip_threat_intel_lookup table, drops events with no match, and assigns an urgency value from the indicator severity and the asset priority.
Treat this as a starting template. Check the field names and lookup names against your own Splunk configuration before you use it.
| tstats summariesonly=true count from datamodel=Network_Traffic where All_Traffic.action=allowed by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port, _time span=5m | rename "All_Traffic.*" as * | lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence, source as ti_source, severity as ti_severity | where isnotnull(threat_type)What you need before you start
The skill assumes an existing Splunk setup. Its source lists these prerequisites. Confirm each one before asking the agent to build anything.
- Splunk Enterprise Security 7.x or later
- Threat Intelligence Management add-on or Threat Intelligence Framework
- API keys for the external feeds you plan to use, such as OTX, MISP, VirusTotal or AbuseIPDB
- KV Store enabled and properly configured in Splunk
- Admin access for modular input configuration
- Python with the requests and splunklib libraries
Safety notes on scripts and network access
The skill runs scripts and uses the network. The OTX example calls the OTX API with your key, and the feed inputs download data from external sources. Review every script and config file before you run it, and confirm which URLs and keys it will use.
The files are templates. The sample code has not been verified against a live environment in the files provided, so test in a non-production Splunk instance first. Do not run the scripts unreviewed on production systems, since they make outbound API calls and handle API keys.
- Read scripts/agent.py and scripts/process.py before running them
- Store API keys securely and never paste them into shared documents
- Test feed ingestion and correlation searches in a lab before production
- Check the Apache-2.0 licence terms that apply to the skill
What people use it for
- Building a KV Store collection of malicious IP addresses fed from a STIX/TAXII source
- Writing a correlation search that flags DNS queries to domains in a threat list
- Creating a modular input that pulls OTX pulse indicators into Splunk
- Setting up file hash lookups so endpoint events can be checked against known malware hashes
Frequently asked questions
How do I install the Splunk Threat Intel Enrichment agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
What do I need to use this skill?
You need Splunk Enterprise Security 7.x or later, the Threat Intelligence Management add-on or Threat Intelligence Framework, KV Store enabled, admin access for modular inputs, and Python with requests and splunklib. You also need API keys for any external feeds you use.
Does the skill work without Splunk Enterprise Security?
No. The source states that the configuration and searches will not run elsewhere and that they require ES 7.x or later.
Is the Splunk Threat Intel Enrichment skill free?
The skill is licensed under Apache-2.0. The source does not state any price. The external feeds you connect, such as OTX or VirusTotal, have their own API key and usage terms, so check those separately.
Why does my threat intel lookup return no matches?
Check that KV Store is enabled and that the collection and lookup names in transforms.conf match the names in your correlation search. Also confirm that the indicators were ingested and that the field names match the collection schema.
Is this skill a finished production pipeline?
No. The source describes the files as templates, and the sample code has not been verified against a live environment. Test everything in a lab before you rely on it.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC engineers and analysts who already run Splunk Enterprise Security and want a starting template for IOC ingestion and matching. It is a poor fit if you do not have ES 7.x or later, or if you expect tested, ready-to-run production code. Review the scripts and API key handling carefully before running anything against live systems.
Download the skill