mcpField
A
analyzing-threat-landscape-with-misp

analyzing-threat-landscape-with-misp

github.com/mukul975Security35.2k252 installsUpdated 8w ago
Repository

About analyzing-threat-landscape-with-misp

A Python skill for SOC analysts investigating threat activity in MISP. It summarizes event, indicator, ATT&CK, actor, and time-trend data into a landscape report.

Key features

  1. 01Event statistics by threat level and date
  2. 02Distribution of IP, domain, hash, and URL attributes
  3. 03MITRE ATT&CK technique analysis
  4. 04Threat actor activity from galaxy clusters
  5. 05Temporal trends in IOC submissions

Use cases

  1. 01Summarizing recent MISP events
  2. 02Identifying prevalent techniques and threat actors
  3. 03Reviewing changes in IOC submissions over time

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-threat-landscape-with-misp

After installing, type/analyzing-threat-landscape-with-mispin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Analyzing Threat Landscape with MISP

When to Use

  • When investigating security incidents that require analyzing threat landscape with misp
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Familiarity with threat intelligence concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install pymisp
  2. Configure MISP URL and API key.
  3. Run the agent to generate threat landscape analysis:
    • Pull event statistics by threat level and date range
    • Analyze attribute type distributions (IP, domain, hash, URL)
    • Identify top MITRE ATT&CK techniques from event tags
    • Track threat actor activity via galaxy clusters
    • Generate temporal trend analysis of IOC submissions
python scripts/agent.py --misp-url https://misp.local --api-key YOUR_KEY --days 90 --output landscape_report.json

Examples

Threat Landscape Summary
Period: Last 90 days
Events analyzed: 1,247
Top threat level: High (43%)
Top attribute type: ip-dst (31%), domain (22%), sha256 (18%)
Top MITRE technique: T1566 Phishing (89 events)
Top threat actor: APT28 (34 events)

Comments

Markdown supported