Builds MISP-backed threat intelligence platform: ingests IOCs from feeds like URLhaus, enriches with VirusTotal/AbuseIPDB, associates via Galaxy/MITRE ATT&CK, exports STIX 2.1 bundles using PyMISP.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
1. 安装依赖：`pip install pymisp requests stix2`
Uses PyMISP to create, enrich, and share threat intelligence events on MISP platform, managing IOCs, integrating feeds, exporting STIX, and handling community sharing workflows.
Deploys MISP via Docker, configures threat feeds, and uses PyMISP API to collect, correlate IOCs from community/commercial sources for security operations.
Uses PyMISP to create, enrich, and share threat intelligence events on MISP, managing IOCs, feeds, STIX exports, and community sharing. For security assessments and incident response.
Share bugs, ideas, or general feedback.
pip install pymisp requests stix2python scripts/agent.py --misp-url https://misp.local --misp-key <api_key> --ingest-feeds --output misp_report.json
from pymisp import PyMISP, MISPEvent, MISPAttribute
misp = PyMISP("https://misp.local", "api_key")
event = MISPEvent()
event.info = "网络钓鱼活动 - 2024-Q1"
event.threat_level_id = 2
event.add_attribute("ip-dst", "185.143.223.47", to_ids=True)
misp.add_event(event)