skills.rest
MHaggis
MHaggisCOMMUNITY
Explore all skills by this author →
Website𝕏@M_haggisGitHub

threat-report-parser

Parse threat reports and generate SIEM-specific detection rules mapped to MITRE ATT&CK.

471|74|Updated Jan 13, 2026
Search Tags:#threat intelligence#siem#kql#sigma#mitre att&ck#detection engineering#cisa
One-click install
npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill threat-report-parser
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-report-parser
Source: https://github.com/MHaggis/Security-Detections-MCP/tree/main/.claude/skills/threat-report-parser
Command: npx skills add https://github.com/MHaggis/Security-Detections-MCP --skill threat-report-parser

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the complex process of translating unstructured threat intelligence reports into actionable security detections, bridging the gap between raw intelligence and practical defense.

Core Features & Use Cases

  • TTP Extraction: Identifies and extracts MITRE ATT&CK techniques, behavioral descriptions, and Indicators of Compromise (IOCs) from various threat intelligence sources.
  • Detection Logic Generation: Formulates detection logic based on identified TTPs, prioritizing behavioral invariants over volatile IOCs.
  • SIEM-Specific Output: Adapts detection logic for multiple SIEM platforms (Splunk, Sigma, Sentinel, Elastic).
  • Use Case: Feed a CISA alert about a new APT campaign into this Skill, and it will output Sigma rules and KQL queries to detect the described TTPs in your environment.

Quick Start

Use the threat-report-parser skill to analyze the provided CISA alert URL and generate detection logic for the identified techniques.

Frequently Asked Questions about threat-report-parser

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert CISA advisories into Splunk or Sentinel detection rules?▼

To convert CISA advisories into Splunk or Sentinel detection rules, you parse unstructured threat intelligence reports to extract TTPs and generate SIEM-specific detection logic. This process prioritizes behavioral invariants mapped to MITRE ATT&CK over volatile IOCs.

How do I extract MITRE ATT&CK techniques from vendor threat intelligence blogs?▼

Extracting MITRE ATT&CK techniques from vendor blogs involves parsing unstructured threat reports to identify behavioral descriptions and IOCs. The extracted information is then mapped directly to the MITRE ATT&CK framework to formulate actionable detection logic.

Can I generate Sigma rules directly from research papers and security alerts?▼

Yes, you can generate Sigma rules directly from research papers and security alerts by parsing the unstructured text for TTPs. The extracted techniques are translated into detection logic and adapted into Sigma format for deployment.

Does this approach prioritize TTP-based detections over static IOCs for SIEM platforms?▼

Yes, this approach prioritizes TTP-based detections over static IOCs for SIEM platforms. It formulates detection logic based on identified behavioral invariants mapped to MITRE ATT&CK, ensuring detections remain effective against evolving threats.

What is the best way to operationalize threat intelligence reports for Elastic security?▼

The best way to operationalize threat intelligence reports for Elastic security is to parse the unstructured text to extract TTPs and behavioral indicators. You then generate SIEM-specific detection rules adapted for Elastic.

Related Skills

Explore More Content & Communication Skills→
SherifEldeebSherifEldeeb
5

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

Community
Intermediate
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-threat-actor-ttps-with-mitre-navigator

Map threat actor TTPs to MITRE ATT&CK Navigator and generate layer JSON files.

Community
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced