Extract, classify, deduplicate, and enrich IOCs into STIX 2.1 observables.
npx skills add https://github.com/robit-man/transcribe-cli --skill ioc-extraction
Please help me install this Agent Skill. Skill: ioc-extraction Source: https://github.com/robit-man/transcribe-cli/tree/main/.claude/skills/ioc-extraction Command: npx skills add https://github.com/robit-man/transcribe-cli --skill ioc-extraction
This Skill automates the extraction, classification, and deduplication of Indicators of Compromise (IOCs) from various investigation artifacts, ensuring consistent and actionable threat intelligence.
Extract all IOCs from the directory '/var/log/auth.log'.
High-intent search queries and answers about installing and using this skill.
To extract IOCs from raw logs, you can process plain text, Markdown, JSON, CSV, and raw log files. The tool automatically identifies, classifies, and deduplicates indicators like IP addresses, domains, and file hashes to reduce noise.
Yes, you can map extracted Indicators of Compromise to STIX 2.1 observables. The tool generates STIX 2.1 observable bundles for seamless integration with threat intelligence platforms and SIEMs.
IOCs classified from investigation artifacts include IP addresses, domain names, file hashes, URLs, email addresses, file paths, and registry keys. The tool automatically categorizes these indicators by type and removes duplicates.
Yes, IOC extraction supports configurable exclusions for trusted IPs and domains. This ensures that known benign indicators are filtered out during the extraction process, providing a clean and actionable list of threats.
The best way to automate threat intelligence extraction for SIEM integration is to process investigation artifacts and generate STIX 2.1 observable bundles. This ensures consistent, categorized, and deduplicated threat data for your monitoring tools.
To deduplicate malicious IPs and domains from multiple log files, scan the directory containing the logs. The tool automatically classifies extracted IOCs by type and removes duplicates, building a clean list for security monitoring.
Yamato-SecurityAnalyze Hayabusa CSV logs to generate Japanese intrusion timelines and incident reports.
Liberty91LTDGenerate STIX 2.1 bundles modeling threat intelligence objects and relationships.
Happy-Technologies-LLCCorrelate security incidents with events, vulnerabilities, and threat intelligence.
GhostPWNExtract and normalize indicators of compromise from threat reports.
