# Analyzing Threat Intelligence Feeds

Analyzes structured and unstructured threat intelligence feeds to extract actionable...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill analyzing-threat-intelligence-feeds -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill analyzing-threat-intelligence-feeds -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill analyzing-threat-intelligence-feeds -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill analyzing-threat-intelligence-feeds -g -a gemini-cli -y`

## Description

Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Analyzing Threat Intelligence Feeds

## When to Use

Use this skill when:
- Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio
- Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema
- Evaluating feed freshness, fidelity, and relevance to the organization's threat profile
- Building automated enrichment pipelines that correlate IOCs against SIEM events

**Do not use** this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline.

## Prerequisites

- Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI
- API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise)
- TAXII 2.1 client library (taxii2-client Python package or equivalent)
- Role with read/write permissions to the TIP's indicator database

## Workflow

### Step 1: Enumerate and Prioritize Feed Sources

List all available feeds categorized by type (commercial, government, ISAC, OSINT):
- Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence
- Government: CISA AIS (Automated Indicator Sharing), FBI InfraGard, MS-ISAC
- OSINT: AlienVault OTX, Abuse.ch, PhishTank, Emerging Threats

Score each feed on: update frequency, historical accuracy rate, coverage of your sector, and attribution depth. Use a weighted scoring matrix with criteria from NIST SP 800-150 (Guide to Cyber Threat Information Sharing).

### Step 2: Ingest via TAXII 2.1 or API

For TAXII-enabled feeds:
```
taxii2-client discover https://feed.example.com/taxii/
taxii2-client get-collection --collection-id <id> --since 2024-01-01
```

For REST API feeds (e.g., Recorded Future):
- Query `/v2/indicator/search` with `risk_score_min=65` to filter low-confidence IOCs
- Apply rate limiting and exponential backoff for API resilience

### Step 3: Normalize to STIX 2.1

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/analyzing-threat-intelligence-feeds/SKILL.md