Automates IOC enrichment from threat intel sources like VirusTotal, Shodan, and MISP using Python pipelines or SOAR playbooks. For SIEM alert triage, phishing IOC batching, reducing analyst time.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
在以下情况下使用本技能：
Automates IOC enrichment with multi-source threat intel via SOAR playbooks or Python pipelines for SIEM alerts, email submissions, and bulk threat feed processing.
Automates enrichment of indicators of compromise (IOCs) with threat intelligence from VirusTotal, Shodan, MISP using SOAR platforms like Cortex XSOAR or Python pipelines for SIEM alerts and bulk IOC processing.
Automates IOC enrichment from VirusTotal, AbuseIPDB, Shodan, MISP for IPs, domains, URLs, hashes. Provides risk scores and disposition suggestions for SOC alert triage and incident investigations.
Share bugs, ideas, or general feedback.
在以下情况下使用本技能：
不适用于在没有人工审查的情况下进行全自动封锁决策——富化自动化应该辅助决策，而非对高影响行动自主执行封锁。
为每种 IOC 类型定义富化流程：
SIEM 告警 → 提取 IOC → 分类类型 → 路由到富化函数
IP 地址 → AbuseIPDB + Shodan + VirusTotal IP + MISP
域名 → VirusTotal Domain + PassiveTotal + Shodan + MISP
URL → URLScan.io + VirusTotal URL + Google Safe Browse
文件哈希 → VirusTotal Files + MalwareBazaar + MISP
→ 聚合结果 → 计算置信度分数 → 更新告警 → 通知分析师
import requests
import time
from dataclasses import dataclass, field
from typing import Optional
RATE_LIMIT_DELAY = 0.25 # VirusTotal 免费版速率限制：4 请求/秒
@dataclass
class EnrichmentResult:
ioc_value: str
ioc_type: str
vt_malicious: int = 0
vt_total: int = 0
abuse_confidence: int = 0
shodan_ports: list = field(default_factory=list)
misp_events: list = field(default_factory=list)
confidence_score: int = 0
def enrich_ip(ip: str, vt_key: str, abuse_key: str, shodan_key: str) -> EnrichmentResult:
result = EnrichmentResult(ip, "ip")
# VirusTotal IP 查询
vt_resp = requests.get(
f"https://www.virustotal.com/api/v3/ip_addresses/{ip}",
headers={"x-apikey": vt_key}
)
if vt_resp.status_code == 200:
stats = vt_resp.json()["data"]["attributes"]["last_analysis_stats"]
result.vt_malicious = stats.get("malicious", 0)
result.vt_total = sum(stats.values())
time.sleep(RATE_LIMIT_DELAY)
# AbuseIPDB
abuse_resp = requests.get(
"https://api.abuseipdb.com/api/v2/check",
headers={"Key": abuse_key, "Accept": "application/json"},
params={"ipAddress": ip, "maxAgeInDays": 90}
)
if abuse_resp.status_code == 200:
result.abuse_confidence = abuse_resp.json()["data"]["abuseConfidenceScore"]
# 计算复合置信度分数
result.confidence_score = min(
(result.vt_malicious / max(result.vt_total, 1)) * 60 +
(result.abuse_confidence / 100) * 40, 100
)
return result
def enrich_hash(sha256: str, vt_key: str) -> EnrichmentResult:
result = EnrichmentResult(sha256, "sha256")
vt_resp = requests.get(
f"https://www.virustotal.com/api/v3/files/{sha256}",
headers={"x-apikey": vt_key}
)
if vt_resp.status_code == 200:
stats = vt_resp.json()["data"]["attributes"]["last_analysis_stats"]
result.vt_malicious = stats.get("malicious", 0)
result.vt_total = sum(stats.values())
result.confidence_score = int((result.vt_malicious / max(result.vt_total, 1)) * 100)
return result
在 Cortex XSOAR 中创建富化 Playbook：
!vt-file-scan 或 !vt-ip-scan 命令!abuseipdb-check-ip 命令!misp-search 进行交叉核对import time
from functools import wraps
def rate_limited(max_per_second):
min_interval = 1.0 / max_per_second
def decorator(func):
last_called = [0.0]
@wraps(func)
def wrapper(*args, **kwargs):
elapsed = time.time() - last_called[0]
wait = min_interval - elapsed
if wait > 0:
time.sleep(wait)
result = func(*args, **kwargs)
last_called[0] = time.time()
return result
return wrapper
return decorator
def retry_on_429(max_retries=3):
def decorator(func):
@wraps(func)
def wrapper(*args, **kwargs):
for attempt in range(max_retries):
response = func(*args, **kwargs)
if response.status_code == 429:
retry_after = int(response.headers.get("Retry-After", 60))
time.sleep(retry_after)
else:
return response
return wrapper
return decorator
每周追踪流水线性能：
| 术语 | 定义 |
|---|---|
| SOAR | 安全编排、自动化和响应——用于自动化安全工作流程并集成不同工具的平台 |
| 富化 Playbook | 向原始安全事件添加上下文情报的自动化工作流序列 |
| 速率限制 | API 提供商对请求频率的限制（如 VirusTotal 免费版：4 请求/分钟）；流水线必须遵守这些限制 |
| 复合置信度分数 | 使用加权公式从多个富化来源聚合信号的单一分数 |
| 扇出模式 | 并行执行多个富化查询以最小化总富化延迟 |