collecting-threat-intelligence-with-misp

Name: collecting-threat-intelligence-with-misp
Availability: InStock
Author: YukiIto1999

Collect threat intelligence from MISP using PyMISP and export IOCs to STIX.

Updated Apr 23, 2026

Search Tags:#osint #threat-intelligence #ioc #stix #misp #cti #pymisp

Ready to run

npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill collecting-threat-intelligence-with-misp

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: collecting-threat-intelligence-with-misp
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/collecting-threat-intelligence-with-misp
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill collecting-threat-intelligence-with-misp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pymisp, requests, stix2, and includes scripts (resource) and references (resource) components.

What problem does it solve?

MISP-based threat intelligence collection is automated, reducing manual gathering and enrichment workload for security operations.

Core Features & Use Cases

Automates retrieval of IOCs from MISP using PyMISP
Exports threat intel to STIX 2.1, CSV, or Suricata-compatible formats
Supports OSINT investigations and CTI pipelines with feed management and correlation

Quick Start

Install and configure a MISP instance and PyMISP, then run the collection workflow with your API key.

Frequently Asked Questions about collecting-threat-intelligence-with-misp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate IOC collection from MISP using PyMISP?▼

Automate IOC collection from MISP using PyMISP by executing a collection workflow with your API key to retrieve and export threat intelligence. This approach requires Python 3.9+, PyMISP, and access to a configured MISP instance.

Can I export MISP threat intelligence to STIX 2.1?▼

Yes, you can export MISP threat intelligence to STIX 2.1. The workflow also supports exporting collected IOCs to CSV or Suricata-compatible formats, utilizing PyMISP and the stix2 library for structured threat data output.

What do I need to set up before collecting threat intelligence with MISP?▼

Before collecting threat intelligence with MISP, you need to install and configure a MISP instance alongside PyMISP and the stix2 library. You also need valid API keys and Python 3.9+ to execute the automated collection workflows.

How does STIX format support OSINT investigations and CTI pipelines?▼

STIX format supports OSINT investigations and CTI pipelines by providing a standardized structure for threat intelligence data. The workflow uses stix2 to export MISP IOCs, enabling automated feed management and correlation for security operations.

Are there limitations when using PyMISP for automated threat intelligence export?▼

Limitations when using PyMISP for automated threat intelligence export include the strict requirement for a properly configured MISP instance and valid API keys. Without this established environment and Python 3.9+, the automated collection and feed management workflows will not function.