agency-threat-intelligence-analyst

You can generate YARA and Sigma detection rules from raw indicators by ingesting threat data into this skill, which analyzes the inputs and outputs high-fidelity rules designed to catch active threats while minimizing false positives.

Yes, you can automatically map adversary behavior to the MITRE ATT&CK framework. This skill tracks threat actor campaigns and monitors their infrastructure evolution, mapping observed behaviors directly to ATT&CK techniques for structured intelligence reporting.

IOC enrichment is the process of adding context to raw indicators of compromise. This skill automates IOC enrichment to transform chaotic threat data into structured, actionable intelligence, providing high-confidence defensive guidance for security operations teams.

This threat intelligence skill requires structured data inputs, utilizing Python dependencies like json, re, and ipaddress to parse raw cyber threat data. You provide the raw IOCs, and it processes them to generate comprehensive intelligence reports.

The best way to analyze raw cyber threat data is to use a skill that applies structured reasoning and adheres to intelligence standards. This approach transforms chaotic inputs into actionable intelligence reports, detection rules, and adversary profiles.

Limitations when automating indicator of compromise enrichment depend on the structure of your raw threat data. The skill relies on Python standard libraries like json, re, and ipaddress to process inputs, so heavily unstructured or incomplete data may require preprocessing before analysis.