agentsclimarketplace
Sign in

Enriching iocs with threat intel sources

Skill meltedinhex/analyst-ai-pack/skills/enriching-iocs-with-threat-intel-sources

Enriches indicators with context from threat-intel sources: planning lookups against reputation, passive DNS, WHOIS, and sandbox/sample databases, scoring confidence, and avoiding operational-security mistakes that tip off adversaries. Activates for requests to enrich IOCs, add threat context, or plan indicator lookups safely.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill enriching-iocs-with-threat-intel-sources

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.2 KB, 530 tokens by cl100k_base, as published. Nobody here has run it

Enriching IOCs with Threat Intel Sources

When to Use

  • You have atomic indicators and need context: reputation, related infrastructure, first/last seen, and known associations.
  • You are scoring indicator confidence before acting or reporting.
  • You must plan lookups without leaking your investigation to the adversary.

Do not use active interaction (visiting a C2 URL, resolving a live domain from your own network) for enrichment — use passive sources to avoid tipping off the adversary.

Prerequisites

  • Defanged indicators (from the defanging skill) and access to enrichment sources/APIs.
  • Awareness of each source's operational-security implications.

Safety & Handling

  • Prefer passive sources (passive DNS, sample DBs, reputation feeds) over active probing.
  • Never submit a customer/internal sample to a public sandbox without authorization — it becomes publicly retrievable and can expose sensitive data.

Workflow

Step 1: Group indicators by type

Separate hashes, domains, IPs, and URLs; each maps to different enrichment sources.

Step 2: Plan the right lookups

Map each type to passive sources: hashes → sample/AV databases; domains → passive DNS, WHOIS, reputation; IPs → ASN/geo, passive DNS, reputation; URLs → URL reputation/sandbox history.

python scripts/analyst.py plan iocs.json

Step 3: Score confidence

Combine source agreement, age, and prevalence into a confidence score; a single hit on one feed is weaker than corroboration across independent sources.

Step 4: Annotate and pivot

Attach context (first seen, related infrastructure, family) and pivot on strong links (shared registrant, hosting, certificate) to expand the picture.

Step 5: Record provenance

Note which source provided each piece of context and when, so the enrichment is auditable and re-checkable.

Validation

  • Each indicator is routed to type-appropriate, passive sources.
  • Confidence reflects corroboration across independent sources, not a single feed.
  • Every enrichment carries source and timestamp provenance.

Pitfalls

  • Actively resolving/visiting live infrastructure and alerting the adversary.
  • Uploading sensitive samples to public services, leaking data.
  • Treating one feed's verdict as ground truth without corroboration.

References

What ships with it: 3 files

3.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.