skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-threat-landscape-assessment-for-sector

Analyzes sector-specific threat actors, ATT&CK techniques, and attack vectors to generate threat landscape reports.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#mitre att&ck#sector analysis#cti#threat actors#Risk Assessment#threat landscape
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-threat-landscape-assessment-for-sector
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-threat-landscape-assessment-for-sector
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/performing-threat-landscape-assessment-for-sector
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-threat-landscape-assessment-for-sector

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires attackcti, requests, pandas, matplotlib.

What problem does it solve?

Security teams need to understand which threat actors target their industry and which techniques they use, but manually correlating MITRE ATT&CK group data, vendor reports, and sector intelligence is slow and error-prone. This Skill automates sector-specific threat landscape assessments to inform risk management and security investment decisions.

Core Features & Use Cases

  • Threat Actor Profiling: Maps known threat groups (e.g., FIN7, Lazarus Group, Sandworm) to sectors like financial, healthcare, energy, government, manufacturing, and technology using MITRE ATT&CK data.
  • Common Technique Ranking: Aggregates ATT&CK techniques across sector-targeting groups to identify the most frequently used TTPs and initial access vectors.
  • Report Generation: Produces a Markdown threat landscape report with actor summaries, technique rankings, attack vectors, and defensive recommendations.
  • Use Case: A financial services CISO needs board-level threat intelligence; run the assessment for the financial sector to profile groups like FIN7 and Carbanak, rank their techniques, and generate an actionable report.

Quick Start

Run a threat landscape assessment for the healthcare sector and generate a report of the top threat actors, techniques, and recommended defenses.

Frequently Asked Questions about performing-threat-landscape-assessment-for-sector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a threat landscape assessment for my industry sector?▼

Use the SectorThreatAssessment class with your sector name (financial, healthcare, energy, government, manufacturing, or technology). It queries MITRE ATT&CK via attackcti to profile known threat groups, ranks their common techniques, and generates a Markdown report with recommendations.

What Python libraries are needed for MITRE ATT&CK threat actor analysis?▼

The workflow requires attackcti to query the ATT&CK knowledge base, plus requests, pandas, and matplotlib for data handling and visualization. Python 3.9 or later is required.

Which threat actors target the financial services sector?▼

The assessment maps groups including FIN7, FIN8, FIN11, Carbanak, Lazarus Group, Cobalt Group, TA505, and GOLD SOUTHFIELD to the financial sector, pulling their documented ATT&CK techniques for analysis.

What are the limitations of using MITRE ATT&CK group data for threat assessments?▼

ATT&CK only documents publicly reported activity, so technique lists are a floor, not a ceiling, and hardcoded sector group mappings go stale as groups rebrand. Corroborate findings with ISAC advisories and vendor reports like M-Trends or CrowdStrike GTR.

How do I keep sector threat actor lists up to date?▼

Refresh the static SECTOR_GROUPS mapping quarterly against current ATT&CK data, vendor annual reports, and your sector ISAC feeds. Normalize vendor naming aliases before ranking groups to avoid double-counting overlapping clusters.

Related Skills

Explore More Software Engineering Skills→
SherifEldeebSherifEldeeb
5

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

Community
Intermediate
drupadsachaniadrupadsachania

threat-hunting

Generate hypotheses and artifacts for MITRE ATT&CK-aligned threat hunting.

Community
Advanced
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
OpenTideHQOpenTideHQ
4

opentide-threat-vector

Convert CTI reports into TVM YAML with ATT&CK mappings and UUIDs.

Official
Advanced