skills.rest
dapperdivers
dapperdiversCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-intel-api

Automate threat intelligence collection and indicator enrichment workflows for security analysis.

1|1|Updated Feb 8, 2026
Search Tags:#security analysis#threat intelligence#cve#nvd#ioc enrichment#cisa kev#rss monitoring
One-click install
npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill threat-intel-api
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-intel-api
Source: https://github.com/dapperdivers/roundtable-arsenal/tree/main/research/threat-intel-api
Command: npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill threat-intel-api

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, jq, bash, python3, feedparser, xmllint, parallel, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill reduces the manual effort required to monitor security feeds, research vulnerabilities, and enrich indicators of compromise by automating threat intelligence collection and analysis workflows.

Core Features & Use Cases

  • Threat Feed Monitoring: Poll security RSS feeds, detect high-severity findings, and generate alerts for emerging threats.
  • Vulnerability Intelligence: Query NVD and CISA KEV databases for CVE details, exploitation status, and remediation context.
  • IOC Enrichment: Combine WHOIS, DNS, geolocation, reputation, and security intelligence sources to investigate IPs, domains, URLs, and hashes.

Quick Start

Use the threat-intel-api skill to analyze a CVE, monitor security feeds, or enrich an indicator of compromise with available threat intelligence sources.

Frequently Asked Questions about threat-intel-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the best way to monitor security RSS feeds for emerging cyber threats?▼

Monitoring security RSS feeds is best handled by automating feed parsing to detect high-severity findings and generating alerts for emerging threats, reducing the manual effort required for real-time cyber threat detection.

How do I enrich indicators of compromise with DNS, WHOIS, and reputation data?▼

IOC enrichment combines WHOIS, DNS, geolocation, and security intelligence sources to investigate IPs, domains, URLs, and hashes, applying validation and caching to format multi-source threat intelligence data.

Do I need specific command-line tools to parse CVE details from NVD and CISA KEV?▼

Querying NVD and CISA KEV databases for CVE details and exploitation status requires command-line tooling including curl, jq, bash, python3, feedparser, xmllint, and parallel to parse and format vulnerability intelligence.

Can I integrate external security intelligence APIs for vulnerability tracking?▼

Integrating external security intelligence APIs requires setting up API connections, feed parsing, caching, and validation to aggregate and format multi-source data for vulnerability tracking and real-time threat detection scenarios.

What are the limitations of automating threat intelligence collection with bash and python3?▼

Limitations of automating threat intelligence collection include dependency on external API availability, rate limits, and the need for consistent validation and caching logic within bash and python3 scripts to handle multi-source feed parsing.

Related Skills

Explore More Legal & Compliance Skills→
BankrBotBankrBot
1.2k

neynar

Fetch Farcaster feeds, look up users, and post casts via Neynar API.

Official
Advanced
dapperdiversdapperdivers
1

threat-intel-aggregator

Aggregate threat intelligence feeds and vulnerability data into daily security briefings.

Community
Advanced
dapperdiversdapperdivers
1

rss-analyzer

Analyze cybersecurity RSS feeds to prioritize threat intelligence entries.

Community
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced