skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

5|Updated Jan 12, 2026
Search Tags:#IOC#MITRE-ATT&CK#threat-intelligence#CTI#intel-report#feed-processing
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill threat-intelligence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-intelligence
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/cybersecurity/threat-intelligence
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill threat-intelligence

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Security teams need a unified way to extract indicators from scattered threat reports, profile threat actors, and map findings to established frameworks to produce consistent intelligence deliverables.

Core Features & Use Cases

  • IOC Extraction: Pull IPs, domains, URLs, hashes, emails, and CVEs from unstructured text.
  • Threat Actor Profiling & MITRE ATT&CK Mapping: Build actor profiles and align techniques for reporting and defense planning.
  • Intelligence Reporting: Generate structured briefs and executive summaries from collected data.
  • Feed Processing: Normalize and consolidate multiple threat feeds for analysis.

Quick Start

Use this skill to parse a sample threat report or feed and generate an IOC list, actor profile, and a threat briefing.

Frequently Asked Questions about threat-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract IOCs from unstructured threat intelligence reports?▼

IOC extraction from unstructured threat reports is automated by parsing text to pull IPs, domains, URLs, hashes, emails, and CVEs into a consolidated list. The skill uses the included cti_utils module to normalize these indicators for analysis.

How do I map threat actor profiles to MITRE ATT&CK techniques?▼

Threat actor profiling and MITRE ATT&CK mapping are automated by building structured actor profiles and aligning their documented techniques. This maps findings to established frameworks to produce consistent intelligence deliverables for defense planning.

What is the best way to normalize multiple threat feeds for analysis?▼

Normalizing multiple threat feeds for analysis is handled through automated feed processing that consolidates scattered indicators. This applies to CTI workflows across blogs and advisories, producing structured intelligence briefs from collected data.

Do I need Python 3.9 to parse threat intelligence feeds?▼

Python 3.9+ is required to run the scripts that parse threat intelligence feeds. Optional requests library is needed for fetching external feeds, while the included cti_utils module handles IOC parsing and reporting without extra dependencies.

Can I generate executive threat briefings from collected IOC data?▼

Generating executive threat briefings from collected IOC data is supported through intelligence reporting features. The skill produces structured briefs and executive summaries by consolidating extracted indicators, actor profiles, and MITRE ATT&CK mappings.

What types of cyber threat intelligence indicators can be pulled from text?▼

Cyber threat intelligence indicators including IPs, domains, URLs, hashes, emails, and CVEs can be automatically pulled from unstructured text. The extraction applies across feeds, blogs, and advisories to support comprehensive CTI workflows.

Related Skills

Explore More Data & Analytics Skills→
windowh1windowh1

research-reporter

Perform web searches, retrieve authoritative sources, and compile findings into a structured report.

Community
Advanced
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
refractionPOINTrefractionPOINT
29

threat-report-evaluation

Evaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.

Official
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced