665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-threat-intelligence-feeds

Normalize threat intelligence feeds into STIX 2.1 indicators.

Updated Aug 23, 2026

Search Tags:#deduplication #threat-intelligence #indicator #taxii #cti #stix-2.1

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-threat-intelligence-feeds-axxxxxxaaann

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-threat-intelligence-feeds
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-threat-intelligence-feeds
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-threat-intelligence-feeds-axxxxxxaaann

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires taxii2-client, stix2, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Ingests and normalizes structured and unstructured threat intelligence feeds into a consistent STIX 2.1 representation to enable automated enrichment and analysis.

Core Features & Use Cases

Ingest CTI feeds from TAXII, MISP, AlienVault OTX, and other REST endpoints, and evaluate their signal-to-noise ratio.
Normalize diverse IOC formats (STIX 2.1 indicators, OpenIOC, YARA) into unified STIX 2.1 objects, and attach campaign context through relationships.
Deduplicate, enrich with external context (e.g., VirusTotal, RiskIQ), score feed quality, and prepare data for distribution to TIPs and SIEMs.
Use Case: A security operations team ingests multiple CTI feeds, standardizes IOCs, and streams a single, enriched bundle ready for ingestion by the SIEM.

Quick Start

Ingest a CTI feed, normalize IOCs to STIX 2.1, deduplicate, and export an enrichment bundle for TIP ingestion.

Frequently Asked Questions about analyzing-threat-intelligence-feeds

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I normalize threat intelligence feeds into STIX 2.1 indicators?▼

To normalize threat intelligence feeds into STIX 2.1 indicators, ingest TAXII 2.1 and REST endpoints to convert diverse IOC formats like OpenIOC and YARA into unified STIX objects for actionable enrichment.

What is the best way to deduplicate IOCs from multiple CTI feeds before SIEM ingestion?▼

The best way to deduplicate IOCs from multiple CTI feeds is to ingest and normalize the data into a consistent STIX 2.1 representation, removing duplicate indicators before exporting an enrichment bundle for SIEM ingestion.

Can I ingest threat intelligence from MISP and AlienVault OTX using a TAXII 2.1 client?▼

Yes, you can ingest threat intelligence from MISP and AlienVault OTX by utilizing TAXII 2.1 and REST endpoints to evaluate their signal-to-noise ratio and standardize the feeds into STIX 2.1 objects.

How does feed quality scoring work for CTI pipelines?▼

Feed quality scoring for CTI pipelines works by applying a configurable scoring mechanism to normalized STIX 2.1 indicators, evaluating the signal-to-noise ratio of ingested feeds to assess their overall value.

Does this approach support enriching STIX 2.1 indicators with external context like VirusTotal?▼

Yes, this approach supports enriching STIX 2.1 indicators by attaching external context from sources like VirusTotal and RiskIQ, and adding campaign context through relationships before distributing data to TIPs and SIEMs.

Related Skills

Explore More Data & Analytics Skills→

analyzing-threat-intelligence-feeds

Converts threat intelligence feeds into normalized, deduplicated STIX 2.1 indicators.

ioc-export

Export IOC collections to CSV, STIX 2.1, OpenIOC, and MISP bundles.

extracting-iocs-from-malware-samples

Extract IOCs from malware samples and export STIX 2.1 and CSV artifacts.

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.