threat-report-parser
CommunityOperationalize threat reports into detections.
AuthorMHaggis
Version1.0.0
Installs0
System Documentation
What problem does it solve?
This Skill automates the complex process of translating unstructured threat intelligence reports into actionable security detections, bridging the gap between raw intelligence and practical defense.
Core Features & Use Cases
- TTP Extraction: Identifies and extracts MITRE ATT&CK techniques, behavioral descriptions, and Indicators of Compromise (IOCs) from various threat intelligence sources.
- Detection Logic Generation: Formulates detection logic based on identified TTPs, prioritizing behavioral invariants over volatile IOCs.
- SIEM-Specific Output: Adapts detection logic for multiple SIEM platforms (Splunk, Sigma, Sentinel, Elastic).
- Use Case: Feed a CISA alert about a new APT campaign into this Skill, and it will output Sigma rules and KQL queries to detect the described TTPs in your environment.
Quick Start
Use the threat-report-parser skill to analyze the provided CISA alert URL and generate detection logic for the identified techniques.
Dependency Matrix
Required Modules
None requiredComponents
references
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: threat-report-parser Download link: https://github.com/MHaggis/Security-Detections-MCP/archive/main.zip#threat-report-parser Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 223,000+ vetted skills library on demand.