Standardize CTI operational workflows with modular SOPs for triage and reporting.
npx skills add https://github.com/Liberty91LTD/cti-skills --skill sops
Please help me install this Agent Skill. Skill: sops Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/sops Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill sops
CTI operations often suffer from inconsistency and delays due to ad-hoc procedures. This Skill provides a standardized set of SOPs to guide daily triage, data handling, reporting, and stakeholder communications, reducing drift and improving response times.
Run SOP-001 daily to begin the intelligence triage workflow and ensure PIRs are up to date.
High-intent search queries and answers about installing and using this skill.
Standard operating procedures for CTI operations coordinate daily intelligence triage, IOC processing, flash reports, and threat actor profile updates to reduce process drift and improve response times across CSIRT teams.
You can standardize CSIRT workflows by applying modular SOP steps that define specific owner roles, execution triggers, and output artifacts for daily triage and IOC validation.
To start the daily intelligence triage workflow, run SOP-001 to initiate the triage process and ensure your Priority Intelligence Requirements are kept consistently up to date.
Yes, these SOPs are explicitly applicable for CSIRT teams performing routine threat intel operations, risk assessments, and executive stakeholder briefings through standardized reporting cadences.
The best way to maintain threat intelligence knowledge management is to execute dedicated SOP steps for Knowledge Cell Maintenance, ensuring consistent ownership and standardized output artifacts.
CTI teams experience delays and inconsistency due to ad-hoc procedures; implementing standardized SOPs for data handling and reporting reduces drift and improves overall response times.
dandyeParse IOC lists, query SIEMs, and enrich matched indicators.
devCharuzuGenerate strategic decision frameworks and board-ready artifacts with risk assessments.
dapperdiversAggregate threat intelligence feeds and vulnerability data into daily security briefings.
sellersessionsConvert descriptions, SOPs, or agents into Claude Desktop skill packages.
