Skip to content
Get packs

IOC Defanging and Sharing Pipeline

Extracts, cleans, defangs and packages threat indicators into STIX 2.1 for safe sharing

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches the agent to take raw threat indicators (malicious URLs, IP addresses, domains, email addresses and file hashes) and turn them into a cleaned, deduplicated list. It produces 'defanged' versions, where links are broken on purpose (for example hxxp and [.] instead of dots) so analysts can paste them into reports or chat without accidentally clicking live malicious links. It also describes building machine-readable STIX 2.1 indicator bundles for distribution through TAXII servers or MISP. The bundled Python script extracts indicators from text and defangs them; the SKILL.md also includes a fuller example pipeline.

Great for

  • Security analysts who write threat reports and need to share IOCs safely
  • Engineers building automated threat-intel feeds to TAXII servers or MISP
  • Teams that currently defang indicators by hand and want a repeatable process

Skip it if

  • People who only need a one-off defanged list: a simple find-and-replace or an existing tool is faster and avoids running extra code
  • Production sharing without review: the regex extraction can produce false positives and misses, and wrong indicators shared to a community can cause harm or blocking of legitimate sites, so human validation is needed
  • Environments where scripts must not run unreviewed, since the bundled script makes network requests

Try asking

  • “Defang this list of IOCs from my incident report so I can paste it into a Slack channel safely”
  • “Extract and deduplicate all URLs, IPs, domains and hashes from this threat blog post”
  • “Convert these indicators into a STIX 2.1 bundle with valid_from dates and TLP:AMBER marking”
  • “Set up a script that pushes new IOCs to our MISP instance after normalization”
Step-by-step guide: how to use IOC Defanging and Sharing PipelineInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    building-ioc-defanging-and-sharing-pipeline.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-ioc-defanging-and-sharing-pipeline.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-ioc-defanging-and-sharing-pipeline.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the extracted indicator list before sharing externally; regex extraction can capture benign domains or miss indicators, and the built-in allowlist is short.
  • Read scripts/agent.py before running it, since it makes HTTP requests with the requests library and the SKILL.md examples are partial (the defang_all section is cut off).
  • Keep credentials for MISP or TAXII in environment variables or a secrets manager, not in prompts or code.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.