Skip to content
Get packs

Automated IOC Enrichment

Adds threat-intel context (VirusTotal, AbuseIPDB, Shodan, MISP) to raw IPs, domains, URLs and hashes automatically.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent how to take raw indicators of compromise, such as suspicious IP addresses, domains, URLs or file hashes, and automatically look them up across several threat intelligence services. The agent then combines the results into a single confidence score and a standard summary so a security analyst sees the context already attached to an alert. It covers designing the workflow, writing Python enrichment functions, building SOAR playbooks in tools like Cortex XSOAR, and handling API rate limits and errors. Its guidance says the output should inform human decisions rather than trigger automatic blocks.

Great for

  • Security engineers building SOAR playbooks that pre-populate SIEM alerts with threat context
  • Analysts or developers writing Python pipelines to bulk-enrich phishing submissions or threat feed IOCs
  • SOC teams trying to reduce triage time with standardized enrichment output

Skip it if

  • Teams wanting fully automatic blocking of IPs or domains without human review, which the skill itself advises against because enrichment scores can be wrong
  • People without threat intelligence API accounts, since most of the workflow depends on paid or rate-limited keys
  • Non-security users looking for general web lookups; the skill is specific to incident triage workflows

Try asking

  • “Write a Python script that takes a list of IP addresses and enriches each with VirusTotal and AbuseIPDB results”
  • “Design a Cortex XSOAR playbook that enriches SIEM alerts with file hash and domain reputation before analyst review”
  • “Add rate limiting and retry-on-429 handling to my existing threat intel enrichment code”
  • “Create a composite confidence score that combines VirusTotal detections with AbuseIPDB confidence”
Step-by-step guide: how to use Automated IOC EnrichmentInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    automating-ioc-enrichment.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip automating-ioc-enrichment.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip automating-ioc-enrichment.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Store API keys in environment variables or a secrets manager rather than hard-coding them in scripts, and use keys with the minimum permissions needed.
  • Review the confidence score thresholds (for example 70 and 40) against your own alert history before routing or auto-closing anything, since the skill's example thresholds are not validated.
  • Keep a human in the loop for high-impact actions and track analyst overrides to tune the scoring over time.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.