skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

building-threat-intelligence-feed-integration

Automates STIX/TAXII threat intelligence feed ingestion, normalization, and distribution to SIEM platforms.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#SoC#ioc#stix#misp#taxii#siem integration
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill building-threat-intelligence-feed-integration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: building-threat-intelligence-feed-integration
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/building-threat-intelligence-feed-integration
Command: npx skills add https://github.com/xalgord/xalgorix --skill building-threat-intelligence-feed-integration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires taxii2-client, stix2, OTXv2, pymisp, requests.

What problem does it solve?

SOC teams struggle to operationalize threat intelligence because feeds arrive in different formats from many sources, causing duplicate IOCs, mislabeled indicator types, and stale entries that generate false positives in detection systems.

Core Features & Use Cases

  • Multi-Source Feed Ingestion: Pull indicators from TAXII 2.1 servers (CISA AIS), AlienVault OTX, and Abuse.ch feeds (URLhaus, Feodo Tracker, MalwareBazaar) using Python clients.
  • STIX 2.1 Normalization and Deduplication: Convert raw IOCs into standardized STIX indicators, deduplicate across sources, and apply confidence scoring and expiration policies.
  • SIEM and MISP Distribution: Push normalized indicators into Splunk ES threat intel collections and MISP events, then monitor feed health with match-rate searches.
  • Use Case: A SOC analyst onboards five new feeds, builds a daily pipeline that ingests, deduplicates, and pushes 45,000 active IOCs to Splunk, and tracks per-feed match rates to retire low-value sources.

Quick Start

Build a threat intelligence feed pipeline that ingests AlienVault OTX and Abuse.ch feeds, normalizes them to STIX 2.1, and pushes the indicators to my Splunk ES threat intel framework.

Frequently Asked Questions about building-threat-intelligence-feed-integration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I ingest STIX/TAXII threat intelligence feeds in Python?▼

Use the taxii2-client library to connect to a TAXII 2.1 server, list collections, and fetch indicator objects filtered by added_after timestamps. Parse each object with the stix2 library to access pattern, confidence, and valid_until fields.

How to push threat intelligence IOCs into Splunk ES?▼

Extract the IOC value from each STIX pattern and POST it to the Splunk REST endpoint /services/data/threat_intel/item/ip_intel with description, weight, and threat_key fields. Verify each indicator round-trips correctly before bulk-pushing to avoid poisoning the feed.

What free threat intelligence feeds are available for SOC teams?▼

AlienVault OTX provides community pulses with IP, domain, hash, and URL indicators. Abuse.ch offers URLhaus, MalwareBazaar, and Feodo Tracker feeds, and CISA AIS distributes STIX/TAXII 2.1 indicators for US organizations.

Why do STIX hash patterns break my IOC extraction code?▼

Splitting a STIX pattern on quotes grabs the wrong token for hash patterns like [file:hashes.'SHA-256' = '...'] because of the extra quoted segment. Parse patterns with the stix2 library or map each object type explicitly instead of naive string splitting.

How long should IOCs stay active before expiring?▼

A common TTL policy expires IP indicators after 30 days, domains after 90 days, and file hashes after one year. Without expiration, sinkholed IPs and CDN ranges keep matching and generate persistent false positives.

When should I not use automated feed integration?▼

Do not use feed pipelines for ad-hoc manual IOC lookups; dedicated enrichment tools like VirusTotal or AbuseIPDB are better suited for single queries. Feed integration is designed for continuous, bulk operationalization of threat intelligence.

Related Skills

Explore More Software Engineering Skills→
noname300989noname300989

threat-intel

Scrape authoritative web sources for live CVEs, exploits, and threat intelligence.

Community
Advanced
dandyedandye
120

full-investigation

Orchestrate Tier 2/3 investigations with IOC analysis, triage, and reporting.

Community
Advanced
balsm-healthbalsm-health
2

analyzing-indicators-of-compromise

Analyze and enrich indicators of compromise using VirusTotal, AbuseIPDB, and MISP.

Official
Advanced
dapperdiversdapperdivers
1

opencti-intel

Retrieve threat intelligence data from OpenCTI via GraphQL queries.

Community
Advanced