Skip to content
Get packs

Analyzing Threat Intelligence Feeds

Guides an agent through evaluating, normalizing (STIX 2.1), deduplicating and enriching threat intelligence feeds and IOCs.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, this skill gives an AI agent a structured playbook for working with cyber threat intelligence feeds: lists of malicious IP addresses, domains, file hashes and attacker tactics. The agent can help rank feed sources by quality, convert indicators into the standard STIX 2.1 format, remove duplicates, enrich them with lookups from services like VirusTotal or Shodan, and suggest how long each indicator should remain active before expiring. It also includes a Python helper script that can connect to a TAXII 2.1 server to list collections and download indicators.

Great for

  • Security analysts or CTI teams building or auditing an indicator ingestion pipeline
  • Developers writing scripts that pull STIX data from TAXII servers and convert it for a SIEM or TIP
  • Teams deciding which commercial or open-source threat feeds are worth paying for or keeping

Skip it if

  • Live incident response or raw packet analysis, which the skill itself says to avoid without an established CTI baseline; acting on stale or low-confidence indicators can disrupt legitimate traffic such as shared CDN IPs
  • Non-security readers looking for a general data analysis tool; it is specific to threat intelligence workflows
  • Blocking decisions made directly from agent output without human review, since the skill advises detection-only rules for confidence below 50

Try asking

  • “Help me normalize this batch of IP and domain IOCs from our OTX export into STIX 2.1 indicator objects with confidence scores.”
  • “Score these five threat feeds on update frequency, accuracy and sector coverage using a weighted matrix.”
  • “Write a script that discovers collections on our TAXII 2.1 server and pulls indicators added since last week.”
  • “Deduplicate IOCs across our MISP and Recorded Future sources and set TTLs by indicator type.”
Step-by-step guide: how to use Analyzing Threat Intelligence FeedsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-threat-intelligence-feeds.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-threat-intelligence-feeds.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-threat-intelligence-feeds.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review any script before running it, and supply credentials through environment variables rather than pasting them into chat.
  • Treat the agent's output as a draft: verify indicators against your own sources before pushing them to blocking controls.
  • Specify your organisation's sector and threat profile in your request so feed scoring and relevance checks are meaningful.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.