菜单
Use when the user asks about ISAC participation, TAXII feeds, MISP communities, FIRST, STIX-based sharing, or how to publish intelligence externally. Covers sharing models, standards, communities, and TLP-governed dissemination.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | intelligence-sharing |
| description | Use when the user asks about ISAC participation, TAXII feeds, MISP communities, FIRST, STIX-based sharing, or how to publish intelligence externally. Covers sharing models, standards, communities, and TLP-governed dissemination. |
| user-invocable | true |
| metadata | {"version":"1.0.0"} |
Intelligence sharing creates a network effect — threats identified by one organisation protect the entire community. However, sharing must be governed, reciprocal, and risk-managed.
Sector-specific sharing communities.
| ISAC | Sector | URL |
|---|---|---|
| FS-ISAC | Financial Services | fs-isac.com |
| H-ISAC | Healthcare | h-isac.org |
| IT-ISAC | Technology | it-isac.org |
| E-ISAC | Energy | eisac.com |
| A-ISAC | Aviation | a-isac.com |
| Auto-ISAC | Automotive | automotiveisac.com |
Benefits: Sector-relevant intelligence, trusted community, pre-vetted members, established TLP norms.
Global incident response community. Membership-based, includes national CERTs and enterprise security teams.
Sharing via: FIRST mailing lists, TF-CSIRT community, CTI SIG.
Open-source threat intelligence platform for sharing IOCs and threat data.
How to share via MISP:
Standards for structured intelligence exchange.
TAXII channels:
Direct sharing with trusted partners under agreed terms.
Requirements:
| TLP | Sharing Scope | Automated Sharing? |
|---|---|---|
| RED | Named recipients only | No |
| AMBER+STRICT | Own organisation | No |
| AMBER | Organisation + need-to-know | Restricted TAXII |
| GREEN | Community | ISAC portals, MISP community |
| CLEAR | Unrestricted | Public TAXII feeds, blogs |
Shared intelligence should meet the same quality standards as internal products:
The number one complaint about shared intelligence: "Just IOCs with no context." Always share the WHY alongside the WHAT.
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules. Routes to the right investigation or analysis skill, then auto-applies rigor skills (source rating, TLP, confidence, likelihood) on the output.
Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.
Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.
Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
