Skip to content
Get packs

Guide · Agent skill

How to use the Threat Intel Feed Integration agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the building-threat-intelligence-feed-integration agent skill, a structured playbook that helps an AI agent build pipelines for pulling threat intelligence feeds into your detection tools. It is aimed at SOC and security engineers and developers who have not used agent skills before. By the end you will know what the skill does, how to add it, how to ask for it, and what to check before running its code.

Threat Intel Feed Integrationmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this page.
  2. 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder.
  3. 3Or upload in the apps. Alternatively, upload it in the Claude apps under Settings → Capabilities → Skills.
  4. 4Install the Python packages. Install Python 3.8+, taxii2-client, stix2 and requests, plus OTXv2 if you use AlienVault OTX.
  5. 5Ask for a pipeline. Describe the feeds, the normalization and the SIEM destination in a natural request.
  6. 6Review and harden the code. Replace placeholder credentials, complete the push code and test against a non-production system.

What does the skill make the agent do?

Once installed, the agent follows a playbook for connecting external threat intelligence feeds, such as STIX/TAXII servers, Abuse.ch and AlienVault OTX, to a security team's detection tools. It guides the agent to write code that downloads indicators of compromise (IOCs) like malicious IPs, domains, URLs and file hashes.

The playbook then converts indicators to the STIX 2.1 standard, removes duplicates, and pushes them to SIEM platforms such as Splunk ES or Elastic. The skill also includes a Python script that performs TAXII and URLhaus ingestion.

  • Ingest from TAXII 2.1 servers, URLhaus, Feodo Tracker and OTX pulses
  • Normalize indicators to STIX 2.1
  • Deduplicate across sources and export a STIX bundle
  • Push to Splunk ES threat intel or MISP

How do you install the skill?

Download the ZIP file from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

  • Personal: ~/.claude/skills/
  • Per project: .claude/skills/ inside your project
  • Claude apps: Settings → Capabilities → Skills

What do you need before you start?

The skill expects Python 3.8 or newer and the taxii2-client and stix2 packages, plus the requests library. The OTXv2 client is only needed if you use AlienVault OTX. A MISP or other Threat Intelligence Platform is recommended, and you need a SIEM such as Splunk ES, Elastic Security or Sentinel to receive the data.

You will also need API keys or credentials for OTX, TAXII servers such as CISA AIS, and any commercial feeds you plan to use. The skill does not provide a destination on its own, so without a SIEM or MISP instance there is nowhere for the data to go.

  • Python 3.8+
  • taxii2-client and stix2 Python packages
  • requests library
  • OTXv2 client library (optional, for AlienVault OTX)
  • MISP or another TIP (recommended)
  • SIEM: Splunk ES, Elastic Security or Sentinel
  • API keys or credentials for OTX, TAXII servers and commercial feeds

How do you trigger the skill with a request?

Ask the agent in plain language what you want built. Name the source and the destination so the agent picks the right part of the playbook. Describe the outcome, such as a deduplicated STIX bundle or a push to your SIEM.

The skill is meant for automated ingestion, not one-off lookups. For a single IP or hash check, the skill itself recommends tools like VirusTotal or AbuseIPDB instead.

  • "Build a pipeline that pulls URLhaus and Feodo Tracker, converts everything to STIX 2.1 and removes duplicates."
  • "Write a script that ingests a TAXII 2.1 collection from CISA AIS for indicators added in the last 24 hours."
  • "Push deduplicated IOCs from our feeds into Splunk ES threat intelligence."
python agent.py --urlhaus --feodo --output ti_bundle.json

What are the safety notes for scripts and network use?

This skill runs scripts and uses the network. Treat the sample code as a starting point, not production code. The sample embeds placeholder credentials in plain text, and the Splunk and other push code is incomplete, so it needs hardening and testing before use.

The Splunk example can skip TLS verification when the SKIP_TLS_VERIFY environment variable is set to true, which the source notes is for self-signed certificates in lab environments. Keep credentials out of source code and review what the script sends over the network before running it against live systems.

  • Replace placeholder credentials and keep secrets out of code
  • Review the push code; it is incomplete as shipped
  • Use SKIP_TLS_VERIFY only in lab environments with self-signed certificates
  • Test against a non-production SIEM first

What are good tips for getting the most out of it?

Start with the open-source feeds, such as Abuse.ch and OTX, to evaluate their quality before committing to commercial threat intelligence platforms. Pick a sensible time window for TAXII pulls so you do not reprocess the same indicators every run.

Keep the deduplication step and check the counts it prints, since the source treats deduplication and feed quality assessment as core parts of the process.

  • Evaluate open-source feeds first
  • Use added-after windows for TAXII pulls
  • Check the unique indicator count after deduplication
  • Route output through MISP for central management

What people use it for

  • Pulling URLhaus and Feodo Tracker feeds into one deduplicated STIX bundle
  • Ingesting indicators added in the last 24 hours from a TAXII 2.1 collection such as CISA AIS
  • Evaluating open-source feeds such as Abuse.ch and OTX before buying a commercial TI platform
  • Pushing normalized IOCs into a Splunk ES threat intelligence collection or a MISP event

Frequently asked questions

How do I install the building-threat-intelligence-feed-integration skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.

What do I need to run this skill?

You need Python 3.8+, the taxii2-client, stix2 and requests packages, and ideally a MISP or other TIP plus a SIEM such as Splunk ES, Elastic Security or Sentinel. OTXv2 is only needed for AlienVault OTX, and OTX and TAXII credentials are needed for those sources.

Is this skill free and what is its licence?

The skill is licensed under Apache-2.0. The sources it uses vary: the skill lists AlienVault OTX, Abuse.ch and CISA AIS as free, while CrowdStrike and Mandiant are listed as commercial.

Can I use this skill for quick IOC lookups?

No. The skill is for automated ingestion. For ad-hoc lookups, the skill itself recommends VirusTotal or AbuseIPDB.

What are the alternatives to this skill?

The skill's own guidance points to VirusTotal and AbuseIPDB for manual lookups. For building pipelines, you can write the code yourself using the taxii2-client and stix2 libraries, which the skill's reference structure is based on.

Why does the script fail or skip certificate checks?

The sample Splunk push can skip TLS verification when SKIP_TLS_VERIFY is set to true, which the source says is intended for self-signed certificates in lab environments. Check your credentials and the TAXII URL and collection ID first, since the sample uses placeholders that must be replaced.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you are a SOC or security engineer or developer who wants a structured starting point for automating threat intelligence ingestion into a SIEM or MISP, and you are willing to review and test the code. Pick something else if you need quick one-off IOC lookups or a finished, production-ready pipeline, since the sample code has placeholder credentials and incomplete push logic.

Download the skill