Skip to content
Get packs

Building a Threat Intelligence Platform

Guides an agent through designing and deploying an open-source threat intel platform (MISP, OpenCTI, TheHive, Cortex).

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

Once installed, the agent can plan and set up a central threat intelligence system that gathers threat indicators from feeds, enriches them with lookup services, shares them in standard formats (STIX/TAXII), and routes high-confidence findings into case management. It provides a Docker Compose starting point, Python examples for configuring feeds and connectors, and helper scripts for indicator classification, TLP sharing labels, and platform health checks. It is aimed at security teams building their own CTI setup, not at end users looking for threat data.

Great for

  • Security engineers standing up a shared CTI platform for a team
  • SOC leads who want a reference architecture linking MISP, OpenCTI, TheHive and Cortex
  • Developers writing integration code for STIX/TAXII-based intelligence sharing

Skip it if

  • People who only want to read threat reports: this skill builds infrastructure and does not supply threat data (the feeds it references are external and must be enabled by you).
  • Production deployment without review: the sample Compose file uses example credentials, a disabled Elasticsearch security setting and plain HTTP service links, which must be hardened first.
  • Non-technical users: it requires Docker, Python, API keys and familiarity with security tooling.

Try asking

  • “Design a threat intelligence platform architecture for a 10-person SOC using MISP and OpenCTI.”
  • “Write a Docker Compose file that runs MISP, OpenCTI, TheHive and Cortex together.”
  • “Create a Python script that enables abuse.ch and CIRCL OSINT feeds in MISP and checks connector status.”
  • “Explain how to connect MISP to OpenCTI and push high-confidence indicators to TheHive cases.”
Step-by-step guide: how to use Building a Threat Intelligence PlatformInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    building-threat-intelligence-platform.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-threat-intelligence-platform.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-threat-intelligence-platform.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review and change all default passwords, tokens and the disabled Elasticsearch security setting in the Compose file before any real use.
  • Run scripts/process.py with --check-health first against a test instance to confirm connectivity before configuring feeds.
  • Keep the TLP labels in scripts/agent.py aligned with your sharing agreements before pushing any intelligence outward.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.