MISP Threat Landscape Analyzer
Summarize a MISP threat-intel server's events, IOC types, actors and tag trends into a report
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent to connect to a MISP server (an open-source platform where security teams share threat intelligence) and pull recent events from a chosen time window. The agent then counts events by threat level, breaks down indicator types such as IP addresses, domains and hashes, and tallies MITRE ATT&CK techniques, threat actor and malware clusters, and tag trends over time. The result is a structured summary report suitable for a threat landscape briefing.
Great for
- Security analysts who already run a MISP instance and want periodic landscape summaries
- Threat intelligence teams preparing trend reports on actors and malware families
- Developers building CTI dashboards who want a starting script using PyMISP
Skip it if
- Users without access to a MISP server, since the skill only analyzes data already in MISP and cannot produce findings from nothing
- Anyone using a production MISP API key on an untested script: the script reads event data and the key grants access to sensitive, possibly restricted intelligence, so use a lab or least-privilege key first
Try asking
- “Analyze the last 90 days of events on our MISP instance and summarize the top threat actors and techniques”
- “Produce a CTI landscape report from MISP with IOC type breakdowns and temporal trends”
- “Which malware families and threat actor galaxy clusters appeared most in our MISP events this quarter?”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-threat-landscape-with-misp.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-threat-landscape-with-misp.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-threat-landscape-with-misp.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run against a test or lab MISP instance first and review the generated JSON before sharing it
- Use a read-only API key with the narrowest access that works, and avoid committing keys to scripts
- Check the example output in SKILL.md is illustrative; verify numbers against your own data before reporting them
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.