Uses PyMISP to create, enrich, and share threat intelligence events on MISP platform, managing IOCs, integrating feeds, exporting STIX, and handling community sharing workflows.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills-zh:performing-threat-intelligence-sharing-with-mispThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
MISP(恶意软件信息共享平台,Malware Information Sharing Platform)是一个开源威胁情报平台,专为收集、存储、分发和共享网络安全指标及威胁信息而设计。PyMISP 是通过 REST API 与 MISP 实例交互的官方 Python 库,支持程序化事件创建、属性管理、标签分配、星系簇(Galaxy Cluster)附加及情报源同步。本技能涵盖使用 PyMISP 创建包含结构化 IOC(IP 地址、域名、文件哈希、URL)的事件、用 MITRE ATT&CK 标签丰富事件、管理共享组(Sharing Group)和分发级别(Distribution Level)、搜索已有情报,以及导出为 STIX 2.1 格式以实现与其他平台的互操作性。
MISP(恶意软件信息共享平台,Malware Information Sharing Platform)是一个开源威胁情报平台,专为收集、存储、分发和共享网络安全指标及威胁信息而设计。PyMISP 是通过 REST API 与 MISP 实例交互的官方 Python 库,支持程序化事件创建、属性管理、标签分配、星系簇(Galaxy Cluster)附加及情报源同步。本技能涵盖使用 PyMISP 创建包含结构化 IOC(IP 地址、域名、文件哈希、URL)的事件、用 MITRE ATT&CK 标签丰富事件、管理共享组(Sharing Group)和分发级别(Distribution Level)、搜索已有情报,以及导出为 STIX 2.1 格式以实现与其他平台的互操作性。
pymisp(pip install pymisp)pip install pymispExpandedPyMISP(url, key, ssl=True) 连接MISPEventevent.add_attribute(type, value) 添加 IP、域名、哈希等属性misp.publish(event) 发布事件misp.search(controller='events', value=..., type_attribute=...) 搜索已有事件JSON 报告,汇总已创建的事件、添加的属性、应用的标签、情报源同步状态,以及与已有情报的关联命中,包含事件 ID 和分发元数据。
npx claudepluginhub killvxk/cybersecurity-skills-zhUse PyMISP to create, enrich, and share threat intelligence events on a MISP platform, including IOC management, STIX export, and community sharing.
Create, enrich, and share threat intelligence events on a MISP platform using PyMISP, including IOC management, feed integration, STIX export, and community sharing.
Uses PyMISP to create, enrich, and share threat intelligence events on MISP, managing IOCs, feeds, STIX exports, and community sharing. For security assessments and incident response.