# Building Threat Feed Aggregation With Misp

Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill building-threat-feed-aggregation-with-misp -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill building-threat-feed-aggregation-with-misp -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill building-threat-feed-aggregation-with-misp -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill building-threat-feed-aggregation-with-misp -g -a gemini-cli -y`

## Description

Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Building Threat Feed Aggregation with MISP

## Overview

MISP is the leading open-source threat intelligence platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat intelligence. It aggregates feeds from OSINT sources, commercial providers, and sharing communities into a unified platform with automatic correlation, STIX/TAXII export, and direct integration with SIEMs and security tools. This skill covers deploying MISP via Docker, configuring feeds from sources like abuse.ch, AlienVault OTX, and CIRCL, setting up automated feed synchronization, and integrating with Splunk, Elasticsearch, and SOAR platforms.


## When to Use

- When deploying or configuring building threat feed aggregation with misp capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation

## Prerequisites

- Docker and Docker Compose for deployment
- Python 3.9+ with `pymisp` library for API interaction
- Linux server with 8GB+ RAM for production deployment
- Understanding of IOC types and threat intelligence lifecycle
- Network access to external feed URLs

## Key Concepts

### MISP Architecture

MISP stores threat intelligence as Events containing Attributes (IOCs) organized by type and category. Events can have Tags (MITRE ATT&CK, TLP marking, sector tags), Galaxies (threat actor profiles, malware families, attack patterns), and Objects (structured groupings of related attributes). Events are correlated automatically across the instance.

### Feed Types

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/building-threat-feed-aggregation-with-misp/SKILL.md