How to use the Threat Feed Aggregation with MISP agent skill

What the skill makes the agent do

An agent skill is a folder of instructions and helper files that an AI agent loads when your request matches the skill's purpose. This skill is about centralised indicator of compromise (IOC) management. MISP stores threat intelligence as Events containing Attributes (IOCs), and it can correlate them automatically across an instance.

Once installed, the agent can walk you through deploying MISP with Docker, configuring feeds from sources such as abuse.ch, AlienVault OTX and CIRCL, setting up automated feed synchronization, and connecting results to Splunk, Elasticsearch or SOAR platforms. The skill also includes a helper Python script, scripts/agent.py, and a reference file, references/api-reference.md, that show how to call the MISP API.

• Deploy MISP via Docker using a docker-compose file as a starting point
• Enable recommended default OSINT feeds and add custom CSV feeds through the PyMISP API
• Search and correlate indicators by value, type and tags
• Explain MISP concepts such as Events, Attributes, Tags, Galaxies, Objects and sharing groups

How to install the skill

You can install the skill in either of two ways. For Claude Code, download the ZIP from this page and unzip it into ~/.claude/skills/ for your user account, or into .claude/skills/ inside a specific project. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills instead.

After installing, the skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md. SKILL.md is the file that describes when the skill applies.

• Option 1, personal: unzip into ~/.claude/skills/
• Option 2, project: unzip into .claude/skills/ in your project folder
• Option 3, Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What you need before you start

The skill assumes a working technical setup. Check these requirements before you begin, because the source describes the setup as not beginner-friendly.

• Docker and Docker Compose for deployment
• Python 3.9 or newer with the pymisp library
• The Python requests library, used by scripts/agent.py
• A MISP instance and an API key
• A Linux server with 8GB+ RAM for production use
• Network access to external feed URLs
• Basic familiarity with APIs and understanding of IOC types

How to trigger the skill with natural requests

You do not need special syntax. Describe the outcome you want in plain language and mention MISP or threat feeds. The skill's description says it applies when you are standing up centralised IOC management or wiring multi-source threat feeds into a SIEM, so requests that match those goals are the most likely to load it.

Be specific about your environment. Say whether you already have a MISP instance, whether you are deploying one, and which SIEM you use. The agent can then focus on the right part of the workflow.

• "Help me deploy MISP with Docker for our security team."
• "Enable the abuse.ch and CIRCL feeds in my MISP instance."
• "Write a script that lists which MISP feeds are enabled and which are not."
• "How do I push MISP indicators into Splunk or Elasticsearch?"

Deploy MISP and configure feeds

The skill's sample docker-compose file uses the coolacid/misp-docker image with a MySQL 8.0 database and Redis 7. It is a starting point only. The source file contains placeholder values such as misp_db_password_change_me and admin_password_change_me, which you must replace before use.

For feeds, the sample PyMISP code defines a manager class. Its enable_default_feeds method turns on a recommended list that includes CIRCL OSINT Feed, Botvrij.eu - Indicators of Compromise, abuse.ch URLhaus Host file, abuse.ch Feodo Tracker, abuse.ch SSL Blacklist, malwaredomainlist and CyberCure - IP Feed. The add_custom_feed method adds a CSV feed, and fetch_all_feeds triggers a fetch for enabled feeds.

MISP supports MISP format, CSV and freetext feeds, and it ships with 80+ default OSINT feeds. Check the feed list in your own instance, since the names in the sample code may differ from what your version shows.

• Replace every placeholder password and the admin passphrase before starting the stack
• Set MISP_BASEURL and admin email to values for your organisation
• Review the feeds before enabling them, since enabling them sends and receives data with external parties

Search and correlate indicators

The skill includes a search function that looks for indicators by value, attribute type and tags, limited to a recent window (30 days by default in the sample code). It sets published and enforceWarninglist options so results are filtered for published events and checked against warninglists.

The API reference shows how to list feeds, enable a feed, fetch feed data, and read the attributes of an event. Use these as building blocks when you need custom queries.

• Search by indicator value or type over a set number of days
• Search events by tag, for example tlp:white

Safety notes: scripts and network access

This skill runs scripts and uses the network. The helper script calls the MISP API, and feeds are fetched from external URLs. Read scripts/agent.py before running it, and confirm that the MISP URL and API key point where you expect.

The sample PyMISP client in the source defaults verify_ssl to False. Review that setting and enable certificate verification for production. The sample docker-compose file also publishes ports 80 and 443 publicly, so place the instance behind appropriate access controls and harden it before exposing it.

Do not use this skill in an environment that cannot send indicator data to third-party feeds or sharing communities. Enabling feeds and synchronization exchanges data with external parties.

• Read scripts/agent.py before running any script
• Check the MISP URL and API key before use
• Turn on SSL verification for production
• Restrict or harden the publicly exposed ports
• Confirm that sharing with external parties is permitted by your policy