Skip to content
Get packs

OpenCTI IOC Enrichment Pipeline

Set up automated threat-intel enrichment of indicators (IPs, domains, hashes) in OpenCTI using VirusTotal, Shodan, AbuseIPDB and GreyNoise.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill gives an AI agent a playbook for building a threat intelligence pipeline on OpenCTI, an open-source platform for storing and organising threat data. Once installed, the agent can walk you through deploying OpenCTI with Docker, configuring enrichment connectors that look up suspicious IPs, domains and files in services like VirusTotal, Shodan, AbuseIPDB and GreyNoise, and writing custom enrichment code. It can also help score indicators so analysts see the most urgent ones first. The bundled Python scripts can query an OpenCTI instance and call those enrichment APIs.

Great for

  • Security engineers deploying OpenCTI who want an enrichment setup starting point
  • Threat intel teams automating triage of newly ingested indicators
  • Developers learning how OpenCTI connectors and STIX 2.1 objects fit together

Skip it if

  • Teams without an OpenCTI instance or the time to run Elasticsearch, RabbitMQ and Redis, since the setup is substantial
  • Anyone who would send sensitive or unreleased indicators to third-party services without checking the data-sharing rules (TLP markings) first, because enrichment sends values to external APIs
  • Production use without review: the scripts and sample config contain placeholder credentials such as a default admin password and were not tested in the files provided

Try asking

  • “Help me deploy OpenCTI with Docker Compose and add VirusTotal and Shodan enrichment connectors.”
  • “Write a custom OpenCTI enrichment connector that checks IPv4 addresses against GreyNoise.”
  • “Create a scoring approach that adjusts indicator confidence from AbuseIPDB report counts.”
  • “Review my pycti enrichment script for errors before I run it against our instance.”
Step-by-step guide: how to use OpenCTI IOC Enrichment PipelineInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    building-ioc-enrichment-pipeline-with-opencti.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-ioc-enrichment-pipeline-with-opencti.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-ioc-enrichment-pipeline-with-opencti.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the scripts and sample docker-compose file before running them; replace the placeholder admin password and tokens, and keep API keys in a secrets manager rather than plain YAML.
  • Check each enrichment service's terms and your TLP markings before sending indicators to external APIs, especially for unpublished threat data.
  • Test first on a non-production OpenCTI instance with a small set of known indicators to confirm connectors and scoring behave as expected.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.