Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T. Use when working with building threat intelligence platform.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. T. Use when working with building threat intelligence platform.
Building a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. This skill covers designing TIP architecture using open-source tools (MISP, OpenCTI, TheHive, Cortex), configuring feed ingestion pipelines, establishing enrichment workflows, implementing STIX/TAXII interoperability, and building analyst dashboards for CTI operations.
When to Use
Trigger phrases:
"building threat intelligence platform"
"Building a Threat Intelligence Platform (TIP) involves deploying and integrating"
When deploying or configuring building threat intelligence platform capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Docker and Docker Compose for deploying platform components
Python 3.9+ with pymisp, pycti, thehive4py libraries
Elasticsearch/OpenSearch cluster for data storage
Redis and RabbitMQ for message queuing
Understanding of STIX 2.1 data model and TAXII 2.1 transport
API keys for enrichment services (VirusTotal, Shodan, AbuseIPDB)
Key Concepts
This section covers key concepts for building threat intelligence platform.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
TIP Architecture Components
Collection Layer: Feed ingestion from OSINT, commercial, and internal sources
Storage Layer: Elasticsearch/OpenSearch for indexed CTI data with STIX 2.1 schema
Analysis Layer: OpenCTI for knowledge graph analysis and MISP for IOC correlation
Enrichment Layer: Cortex analyzers for automated IOC enrichment
Response Layer: TheHive for case management and incident response integration
Sharing Layer: TAXII server for outbound intelligence sharing
Platform Integration Points
MISP <-> OpenCTI: Bidirectional sync via OpenCTI MISP connector
OpenCTI <-> TheHive: Alert/case creation from high-confidence indicators
TheHive <-> Cortex: Automated analysis and enrichment of case observables
All <-> SIEM: Real-time IOC push to Splunk/Elastic via API or Kafka
Workflow
Scope the task — define objectives, boundaries, and success criteria
Gather information — collect all necessary data and context before proceeding
Execute the core workflow — follow the domain-specific steps methodically
Validate results — verify outputs against expected outcomes or baselines
Document findings — record results, anomalies, and recommendations
