skills.rest
chenchunrun
chenchunrunCOMMUNITY
Explore all skills by this author →
GitHub

ttp-extractor

Extract MITRE ATT&CK techniques from security reports and generate Sigma rules.

1|1|Updated Apr 25, 2026
Search Tags:#security-automation#threat-hunting#threat-intelligence#mitre-attack#ttp-extraction#sigma-rules#attack-mapping
One-click install
npx skills add https://github.com/chenchunrun/onyx-soc --skill ttp-extractor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ttp-extractor
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/ttp-extractor
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill ttp-extractor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps security teams automatically extract attack techniques, defensive gaps, and MITRE ATT&CK mappings from security reports and threat intelligence, enabling faster threat understanding and response.

Core Features & Use Cases

  • TTP extraction from reports and intel, with ATT&CK mapping
  • Sigma rule generation for detections and alerting
  • Threat hunting queries and defensive recommendations for SOC workflows
  • Use Case: When provided with a security report, produce ATT&CK-aligned techniques, detection rules, and hunting queries for incident response.

Quick Start

Analyze a security report to extract ATT&CK techniques and generate Sigma rules for detections.

Frequently Asked Questions about ttp-extractor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract MITRE ATT&CK techniques from threat intelligence reports?▼

To extract MITRE ATT&CK techniques from threat intelligence reports, you can automatically identify attack techniques within the text and map them directly to the corresponding ATT&CK framework categories. This enables faster threat understanding and incident response.

Can I generate Sigma rules from security reports for SOC workflows?▼

Yes, you can generate Sigma rules from security reports by extracting the identified attack techniques and translating them into detection rules. This process also yields threat hunting queries and defensive recommendations suitable for SOC automation.

What is the best way to map threat hunting queries to MITRE ATT&CK?▼

The best way to map threat hunting queries to MITRE ATT&CK is to analyze security reports to identify attack techniques, map them to ATT&CK, and apply the analysis to generate structured hunting queries. This aligns detections directly with known adversary behaviors.

Does this TTP extraction approach output structured data for security automation pipelines?▼

Yes, this TTP extraction approach exports results in a structured format suitable for ingestion into a security automation pipeline. It packages ATT&CK mappings, Sigma rules, and hunting queries for automated defense workflows.

How do I identify defensive gaps from threat intelligence reports?▼

You identify defensive gaps from threat intelligence reports by automatically extracting attack techniques and mapping them to MITRE ATT&CK. This process highlights uncovered adversary behaviors and generates defensive recommendations for your SOC.

Related Skills

Explore More Data & Analytics Skills→
SherifEldeebSherifEldeeb
5

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

Community
Intermediate
allanninalallanninal
1

threat-hunting

Apply Sigma detection rules to investigate security incidents.

Community
Advanced
ddttomddttom

create-blog

Convert Markdown blog drafts into semantic, WCAG 2.1 AA compliant HTML with extracted SVGs and metadata.

Community
Advanced
MHaggisMHaggis
471

cti-detection-engineer

Generate multi-SIEM detection logic from threat intelligence and MITRE ATT&CK mappings.

Community
Advanced