Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Threat Landscape With Misp

SkillScore41Maintained

analyzing-threat-landscape-with-misp

Analyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type breakdowns, identify top threat actors and malware families, and generate threat landscape reports with temporal trends.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-threat-landscape-with-misp/SKILL.md

decimalai skills pull analyzing-threat-landscape-with-misp --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-threat-landscape-with-misp/SKILL.md https://app.decimal.ai/s/analyzing-threat-landscape-with-misp/SKILL.md

Raw file: /s/analyzing-threat-landscape-with-misp/SKILL.md ↗ · machine-readable summary at /s/analyzing-threat-landscape-with-misp.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—-3% tokens0% turns41% of whole cases pass with skill (9/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-20	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-18	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-threat-landscape-with-misp/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Analyzing Threat Landscape with MISP

When to Use

When investigating security incidents that require analyzing threat landscape with misp
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with threat intelligence concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install pymisp
Configure MISP URL and API key.
Run the agent to generate threat landscape analysis:

Pull event statistics by threat level and date range
Analyze attribute type distributions (IP, domain, hash, URL)
Identify top MITRE ATT&CK techniques from event tags
Track threat actor activity via galaxy clusters
Generate temporal trend analysis of IOC submissions

bash
python scripts/agent.py --misp-url https://misp.local --api-key YOUR_KEY --days 90 --output landscape_report.json

Examples

Threat Landscape Summary

Period: Last 90 days
Events analyzed: 1,247
Top threat level: High (43%)
Top attribute type: ip-dst (31%), domain (22%), sha256 (18%)
Top MITRE technique: T1566 Phishing (89 events)
Top threat actor: APT28 (34 events)

Illustrative Want to see what analyzing-threat-landscape-with-misp would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 07:55 UTC · 22 cases

Measured on 19 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+36%

41% vs 5%

Agent turns

1.0 vs 1.0

Tokens

-3%

1,794.26 vs 1,842.68

fail → pass · 8pass → pass · 1fail → fail · 13

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-10 How do we pass our secret authentication token to the threat landscape analysis script on execution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I need a quarterly threat intelligence summary from our local MISP instance. Please aggregate the threat data for the past 90 days, breaking down threat levels, top attribute types like domains and hashes, main threat actors, and frequently observed MITRE ATT&CK techniques into a formatted JSON output file.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Write a Python snippet using PyMISP to create a new MISP event titled 'Phishing Campaign 2026-03' and add a malicious domain attribute `bad-site.org` to it.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Which standard indicator attribute types are categorized and analyzed during the MISP attribute distribution analysis?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 What is the minimum Python runtime version required to execute the MISP landscape analysis tool?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 We need the MISP threat landscape report to analyze event statistics specifically over a 60-day window instead of the default. Which command-line option sets this duration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When aggregating high-level event statistics, how are MISP events categorized by severity or impact?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When running the landscape analysis tool against our local MISP endpoint at https://misp-server.local, which command-line argument specifies the server location?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What specific temporal trend metric does the MISP threat landscape script calculate across the requested date range?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Could you run a landscape assessment against our MISP platform covering the last three months? I need a JSON report summarizing event stats, attribute distributions, active APT galaxy clusters, and temporal IOC trends to help evaluate our threat monitoring coverage.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 What administrative condition must be met before executing threat landscape analysis scripts against an enterprise MISP instance?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 How do SOC administrators define a new threat actor entry within a custom MISP galaxy cluster JSON file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 We want to save the generated threat landscape report to a file named `quarterly_threats.json`. Which command-line option designates the output file path?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We need to create a custom MISP warning list in JSON format to prevent false positives for our internal RFC 1918 IPv4 subnets. How do we structure this JSON warning list file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 How does the MISP threat landscape tool identify and track specific threat actor activity in the aggregated events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Provide the exact shell command to run a 30-day threat landscape report against `https://misp.security.org` with API key `sec_key_123` outputting to `report_30d.json`.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 What top-level metrics should be included in a MISP threat landscape summary report based on analyzed events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Our team is updating detection rules and needs to evaluate recent threat landscape metrics in MISP. Please pull event statistics, tag-based ATT&CK technique counts, and threat actor activity over the last 90 days, generating a JSON landscape report.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are setting up a fresh environment to execute MISP threat landscape analysis scripts. Which Python library must be installed beforehand?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 I want to run the pre-built CLI tool for MISP threat landscape reporting on a server at https://misp.corp.internal. Which script file path should be executed?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When evaluating MITRE ATT&CK techniques across threat landscape events in MISP, where does the analysis agent extract technique information from?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Our SOC team wants to use MISP threat landscape reports to improve active monitoring. What artifact can be created directly from the top ATT&CK techniques identified?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 19 counted toward the lift figure. The other 3 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +36 percentage points is the difference between those two pass rates over the 19 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 40.9%
Cases attempted: 22
Cases counted toward lift: 19
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 07:55 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run41

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-38% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.