skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

performing-threat-intelligence-sharing-with-misp

Automate MISP event creation, enrichment, and distribution with PyMISP.

Updated Apr 23, 2026
Search Tags:#osint#threat-intelligence#stix#misp#taxii#pymisp#ioc-sharing
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-threat-intelligence-sharing-with-misp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-threat-intelligence-sharing-with-misp
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/performing-threat-intelligence-sharing-with-misp
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-threat-intelligence-sharing-with-misp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pymisp, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Sharing threat intelligence across teams and tools is often manual, inconsistent, and slow. This skill automates creating, enriching, and distributing threat intelligence events on a MISP platform using PyMISP, enabling structured IOC management, feed integration, STIX export, and community sharing workflows.

Core Features & Use Cases

  • Create MISP events with indicators such as IPs, domains, file hashes, and URLs; enrich events with MITRE ATT&CK tags; and manage distribution and sharing groups
  • Integrate threat intelligence feeds and export events in STIX 2.1 format for interoperability with other platforms
  • Support OSINT investigations, incident response workflows, scheduled testing, and security assessments requiring scalable threat intel sharing
  • Validate sharing configurations and ensure proper tagging and distribution levels

Quick Start

Configure your MISP instance and run the agent to start creating events, enriching IOCs, and sharing intelligence.

Frequently Asked Questions about performing-threat-intelligence-sharing-with-misp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate MISP threat intelligence sharing with Python?▼

You can automate MISP threat intelligence sharing by using the PyMISP library to orchestrate event creation, attribute enrichment, and distribution across MISP instances. This requires Python 3.9+, PyMISP, and a configured MISP instance with an API key.

How do I export MISP events to STIX 2.1 format?▼

Exporting MISP events to STIX 2.1 format is supported directly through the Skill's automation workflow for interoperability with other platforms. This enables structured IOC management and feed integration during OSINT investigations.

Can I enrich MISP IOCs with MITRE ATT&CK tags automatically?▼

Yes, you can enrich MISP IOCs with MITRE ATT&CK tags automatically. The Skill orchestrates event creation for indicators like IPs, domains, and file hashes, then applies MITRE mappings and manages distribution sharing groups.

What do I need to configure before sharing threat intelligence on MISP?▼

Before sharing threat intelligence on MISP, you need a properly configured MISP instance with a valid API key, Python 3.9 or higher, and the pymisp library installed. This environment setup enables automated event creation and STIX exports.

Does PyMISP support scheduled threat intelligence sharing workflows?▼

Yes, PyMISP supports scheduled threat intelligence sharing workflows for incident response and security assessments. The Skill automates validating sharing configurations, ensuring proper tagging, and managing distribution levels across MISP instances.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

collecting-threat-intelligence-with-misp

Collect threat intelligence from MISP using PyMISP and export IOCs to STIX.

Community
Advanced
bbrowningbbrowning
2

Reviewing Authentication and Authorization Security

Automate security reviews of JWT, OAuth 2.0/2.1, PKCE, and token exchange code.

Community
Advanced
YukiIto1999YukiIto1999

performing-ioc-enrichment-automation

Automate IOC enrichment across VirusTotal, AbuseIPDB, Shodan, and GreyNoise.

Community
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced