skills.rest
jaskaranhundal
jaskaranhundalCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

3|3|Updated Mar 8, 2026
Search Tags:#security analysis#attribution#threat intelligence#mitre att&ck#ioc enrichment#cyber threat actor
One-click install
npx skills add https://github.com/jaskaranhundal/usap-skills --skill threat-intelligence-jaskaranhundal
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-intelligence
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/detection/threat-intelligence
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill threat-intelligence-jaskaranhundal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill enriches security events with critical threat intelligence, helping security analysts understand the context of threats, attribute them to known adversaries, and prioritize response actions.

Core Features & Use Cases

  • Indicator Enrichment: Classifies and enriches Indicators of Compromise (IOCs) like IP addresses, domains, and file hashes.
  • MITRE ATT&CK Mapping: Maps observed behaviors to specific MITRE ATT&CK techniques.
  • Threat Actor Assessment: Assesses the likelihood of threat actor categories (nation-state, criminal, etc.).
  • Use Case: When a network intrusion alert fires, this Skill can identify the involved IP addresses, map the activity to techniques like "Exploit Public-Facing Application," and assess if the activity aligns with a known nation-state actor.

Quick Start

Enrich the provided security fact with threat intelligence context.

Frequently Asked Questions about threat-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enrich Indicators of Compromise with threat intelligence context?▼

Threat intelligence enrichment classifies Indicators of Compromise (IOCs) like IP addresses, domains, and file hashes to add critical context to security events. This helps analysts understand the nature of the threat and prioritize response actions.

How can I map observed security behaviors to MITRE ATT&CK techniques?▼

Mapping observed behaviors to MITRE ATT&CK techniques involves analyzing network intrusion alerts and identifying specific adversary tactics, such as "Exploit Public-Facing Application." This process translates raw security events into standardized adversary behaviors.

What is cyber threat actor attribution and how does it work?▼

Cyber threat actor attribution assesses the likelihood that a threat originates from specific categories, such as nation-state or criminal groups. It works by evaluating enriched security events and mapped behaviors against known adversary profiles to guide response priorities.

Can I assess threat actor categories for network intrusion alerts?▼

Yes, you can assess threat actor categories for network intrusion alerts. By identifying involved IP addresses, mapping the activity to MITRE ATT&CK techniques, and evaluating the context, you can determine if the activity aligns with known threat actors.

Do I need external dependencies to perform IOC enrichment and MITRE ATT&CK mapping?▼

No external dependencies are required to perform IOC enrichment and MITRE ATT&CK mapping. The Skill operates independently using its internal scripts, references, and assets to evaluate security facts and provide actionable intelligence.

Related Skills

Explore More Data & Analytics Skills→
hackersifuhackersifu
33

re-ioc-extraction

Extract and normalize defensive IOCs from analyst evidence into Markdown and YAML lists.

Community
Intermediate
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
dandyedandye
120

hunt-apt

Integrate threat actor profiles and intelligence to locate and report on IoCs and MITRE techniques in real-time network traffic.

Community
Advanced