Skip to content
Get packs

Threat Intel Feed Integration

Builds pipelines that pull threat intelligence feeds into SIEM tools for automated IOC matching.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent gains a structured playbook for connecting external threat intelligence feeds (STIX/TAXII servers, Abuse.ch, AlienVault OTX and similar sources) to a security team's detection tools. It guides the agent to write code that downloads indicators of compromise such as malicious IPs, domains, URLs and file hashes, converts them to the STIX 2.1 standard, removes duplicates, and pushes them to SIEM platforms like Splunk ES or Elastic. It also includes a Python script that performs TAXII and URLhaus ingestion.

Great for

  • SOC or security engineers who want to automate threat intelligence ingestion into a SIEM
  • Developers building TI pipelines who want a reference structure using STIX/TAXII libraries
  • Teams evaluating open-source feeds such as Abuse.ch and OTX before committing to commercial TI platforms

Skip it if

  • Ad-hoc, one-off IOC lookups; the skill itself says to use tools like VirusTotal or AbuseIPDB instead
  • Production use without review: the sample code embeds placeholder credentials in plain text and the Splunk and other push code is incomplete, so it needs hardening and testing
  • Organisations without a SIEM or MISP instance to receive the data, since the pipeline has no destination on its own

Try asking

  • “Build a Python pipeline that pulls the last 24 hours of indicators from a TAXII 2.1 server and normalises them to STIX 2.1”
  • “Write a script that downloads the Abuse.ch URLhaus recent CSV, filters for online URLs, and deduplicates them”
  • “Create a workflow that pushes deduplicated IP indicators into a Splunk ES threat intelligence collection”
Step-by-step guide: how to use Threat Intel Feed IntegrationInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    building-threat-intelligence-feed-integration.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-threat-intelligence-feed-integration.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-threat-intelligence-feed-integration.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Store TAXII usernames, passwords and API keys in environment variables or a secrets manager rather than in scripts, as the examples hard-code placeholders.
  • Review scripts/agent.py and any generated code before running it, since it makes outbound network requests to external feed servers and SIEM endpoints.
  • Test ingestion against a non-production SIEM instance first and confirm that feed licence terms permit redistribution into your tools.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.