Skip to content
Get packs

Correlating Threat Campaigns

Links related security incidents and indicators into campaign-level threat intelligence reports.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent helps a security analyst group separate incidents that appear to be part of one coordinated operation. It walks through shared infrastructure, malware, timing and targeted sectors, scores how strong the links are, and drafts a campaign report with a timeline, suspected actor, shared indicators and detection guidance. It also includes a Python helper that queries a MISP threat-sharing server over its REST API.

Great for

  • Threat intelligence analysts building campaign reports from several incidents
  • Security teams receiving indicators from ISAC partners that match their own past events
  • SOC leads who want a structured way to decide whether incidents are linked

Skip it if

  • Quick single-incident triage, since the workflow assumes weeks or months of historical data (90+ days recommended) and a MISP or TIP setup
  • Forcing links between incidents on weak signals, which the skill itself warns produces false attribution and wrong threat models
  • Organisations without a MISP instance or graph tool, since several steps depend on them

Try asking

  • “Several incidents this quarter reuse the same C2 IP range and Cobalt Strike config; help me determine whether they form one campaign.”
  • “Our ISAC partner shared indicators from a healthcare intrusion; correlate them with our historical MISP events.”
  • “Draft a campaign intelligence report with timeline, suspected actor, shared IOCs and Sigma rules for this activity.”
Step-by-step guide: how to use Correlating Threat CampaignsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    correlating-threat-campaigns.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip correlating-threat-campaigns.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip correlating-threat-campaigns.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the MISP script before running it: it disables SSL certificate verification by default (verify_ssl=False) and sends the API key in headers, so point it only at a trusted server and enable verification where possible.
  • Treat the confidence score as a prompt for analyst judgement, not a verdict; the weights in the example function are illustrative and the helper functions it calls are not defined in the excerpt.
  • Ask the agent to list the evidence behind each link and to flag shared CDN or hosting infrastructure before accepting an attribution.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.