pilot-threat-intelligence-setup

Orchestrate a four-node threat intelligence pipeline for IOC collection, enrichment, analysis, and STIX/TAXII distribution.

7|3|Updated Apr 8, 2026

Search Tags:#enrichment #data-flow #threat-intelligence #mitre-attack #security-operations #ioc #pilot-protocol

Ready to run

npx skills add https://github.com/TeoSlayer/pilot-skills --skill pilot-threat-intelligence-setup

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pilot-threat-intelligence-setup
Source: https://github.com/TeoSlayer/pilot-skills/tree/main/skills/pilot-threat-intelligence-setup
Command: npx skills add https://github.com/TeoSlayer/pilot-skills --skill pilot-threat-intelligence-setup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Deploy a threat intelligence platform that orchestrates four agents to collect, enrich, analyze, and distribute indicators of compromise for rapid security response.

Core Features & Use Cases

Four-role architecture: collector, enricher, analyzer, and distributor to build a complete threat intel workflow.
Data-flow orchestration: standardized pipelines for raw IOCs, enriched IOCs, and threat verdicts with MITRE mappings.
Deployment readiness: step-by-step setup, role assignment, and conflict-free handshakes across distributed agents.

Quick Start

Install the four role-specific skills with clawhub, configure each agent's hostname, and write the threat-intelligence manifest to the agent configuration.

Frequently Asked Questions about pilot-threat-intelligence-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I orchestrate a threat intelligence pipeline for IOC aggregation and enrichment?▼

To orchestrate a threat intelligence pipeline for IOC aggregation, you deploy a four-role architecture comprising collector, enricher, analyzer, and distributor agents. This structure standardizes data flows for raw IOCs, enriched IOCs, and threat verdicts with MITRE mappings across distributed agents.

What is the best way to distribute threat intelligence using STIX/TAXII publishing?▼

The best way to distribute threat intelligence using STIX/TAXII publishing is through a dedicated distributor agent within a four-node pipeline. This agent handles the final distribution of analyzed indicators of compromise after upstream collection, enrichment, and analysis roles process the raw data.

Do I need a running Pilot daemon to set up threat intelligence collection agents?▼

Yes, you need a running Pilot daemon to set up threat intelligence collection agents. The pipeline requires pilot-protocol skills, the pilotctl binary, and clawhub to coordinate roles, assign hostnames, and establish conflict-free handshakes across distributed agents.

How does the MITRE ATT&CK mapping process work within a threat intelligence workflow?▼

The MITRE ATT&CK mapping process works within a threat intelligence workflow by passing enriched IOCs through a dedicated analyzer agent. This role processes enriched indicators to generate threat verdicts mapped to MITRE ATT&CK techniques before final STIX/TAXII distribution.

Can I use clawhub to install role-specific skills for security operations?▼

Yes, you can use clawhub to install role-specific skills for security operations. The setup involves installing the four role-specific threat intelligence skills via clawhub, configuring each agent's hostname, and writing the threat-intelligence manifest to the agent configuration.

What are the limitations of a four-node threat intelligence pipeline for distributed agents?▼

The primary limitation of a four-node threat intelligence pipeline is its dependency on specific infrastructure, requiring the pilotctl binary, clawhub, pilot-protocol skills, and a running Pilot daemon to coordinate the collector, enricher, analyzer, and distributor roles without conflicts.