skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-threat-intelligence-lifecycle-management

Implements a six-phase threat intelligence lifecycle from requirements definition through dissemination and feedback.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#ioc#stix#misp#cti#intelligence lifecycle#collection pipeline
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-threat-intelligence-lifecycle-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-threat-intelligence-lifecycle-management
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/implementing-threat-intelligence-lifecycle-management
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-threat-intelligence-lifecycle-management

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pymisp, stix2, requests, pandas.

What problem does it solve?

Security teams often collect threat feeds without structure, producing data overload instead of actionable intelligence. This Skill implements the full intelligence cycle—direction, collection, processing, analysis, dissemination, and feedback—so raw data from sources like CISA KEV, OTX, and MalwareBazaar becomes decision-ready intelligence tied to Priority Intelligence Requirements.

Core Features & Use Cases

  • Requirements Management: Define and prioritize PIRs with stakeholders, intelligence levels, and mapped collection sources.
  • Collection & Processing Pipelines: Pull from CISA KEV, AlienVault OTX, and MalwareBazaar, then normalize, deduplicate, and score indicators with confidence and TLP tagging.
  • Analysis, Dissemination & Feedback: Produce requirement-linked intelligence products, distribute them across channels, and capture stakeholder feedback with program metrics.
  • Use Case: A CTI team needs to answer "Which vulnerabilities are actively exploited in our sector?" Use this Skill to define the PIR, collect from CISA KEV, deduplicate indicators, and distribute a daily brief to the SOC.

Quick Start

Use this skill to define priority intelligence requirements and build a collection pipeline pulling from CISA KEV and MalwareBazaar, then produce a daily threat intelligence brief.

Frequently Asked Questions about implementing-threat-intelligence-lifecycle-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a threat intelligence lifecycle program?▼

Start by defining Priority Intelligence Requirements with stakeholders and priorities, then map each PIR to collection sources like CISA KEV or OTX. Process data through normalize, deduplicate, enrich, and score stages before analysis, dissemination, and feedback collection.

How to collect threat intelligence from CISA KEV and AlienVault OTX?▼

Query the CISA KEV JSON feed directly via HTTP GET for known exploited vulnerabilities, and use the OTX API with an API key to fetch subscribed pulses modified within a time window. Both return JSON that feeds into a normalization pipeline.

What Python libraries are needed for threat intelligence processing?▼

The workflow uses requests for feed collection, pymisp and stix2 for threat intelligence platform integration and STIX formatting, and pandas for data handling. Python 3.9 or later is required.

Why does my threat feed produce duplicate indicators?▼

Duplicates occur when the processing stage is skipped or deduplication keys are too broad. Hash on type:value:source so identical indicators from different contexts are not over-merged, and confirm the pipeline reports duplicates removed.

Can I integrate this with MISP or a SIEM like Splunk?▼

Yes, the prerequisites include MISP or OpenCTI as the intelligence platform and Splunk or Elastic for indicator operationalization. Ticketing systems like Jira or ServiceNow handle requirements management.

What are common mistakes when setting up a CTI program?▼

Common failures include collecting feeds without defined PIRs, skipping the processing stage, leaving confidence and TLP defaults unset, omitting indicator expiration, and lacking a feedback loop to validate products against requirements.

Related Skills

Explore More Software Engineering Skills→
daemon-blockint-techdaemon-blockint-tech
7

cti-analyst

Vet and package cyber threat intelligence with STIX/TAXII exports and ATT&CK mappings.

Community
Advanced
hiktan44hiktan44

Threat Detection Engineer

Develops and maintains SIEM security detections using Sigma and MITRE ATT&CK mapping.

Community
Advanced
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced