Splunk Threat Intel Enrichment
Guides an agent to build Splunk threat-intel feeds, lookups and IOC-matching correlation searches
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
When installed, the agent gets guidance for setting up threat intelligence in Splunk Enterprise Security: pulling indicators of compromise (such as bad IP addresses, domains and file hashes) from feeds like STIX/TAXII, CSV lists, OTX, MISP or VirusTotal into KV Store lookup collections. It can then write Splunk search language queries that check network and security logs against those indicators so analysts see matches faster. The skill also includes Python helper scripts for normalizing indicators, expiring old ones and fetching OTX pulse data.
Great for
- SOC engineers configuring Splunk Enterprise Security threat intel
- Security analysts writing IOC-matching correlation searches
- Teams wanting a starting template for threat feed ingestion into Splunk
Skip it if
- Users without Splunk Enterprise Security; the configuration and searches will not run elsewhere (requires ES 7.x or later)
- Anyone expecting a finished, tested production pipeline: the files are templates and the sample code has not been verified against a live environment in the files provided
- Users who would run the scripts unreviewed on production systems, since they make outbound API calls and handle API keys
Try asking
- “Help me set up an OTX modular input in Splunk to pull IP indicators into a KV Store collection”
- “Write a correlation search that flags allowed firewall traffic to IPs in my ip_threat_intel lookup”
- “Show me how to define collections.conf and transforms.conf for domain and file hash intel”
- “Normalize my CSV blocklist into the ip_intel fields used by the enrichment pipeline”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
building-threat-intelligence-enrichment-in-splunk.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-threat-intelligence-enrichment-in-splunk.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-threat-intelligence-enrichment-in-splunk.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py and scripts/process.py before running them, and test in a non-production Splunk instance first
- Store API keys in Splunk's encrypted credential storage rather than plain text config files
- Check the example feed URLs and collection names against your own environment, since several are placeholders
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.