Skills
16
runnable routines
Enrichment
⚡ Resolve Everything
Attribute country/ASN to IPs, hosting to domains, family to hashes — all from local data.
Run →
✨ Enrichment Runner
Pull VT/OTX/AbuseIPDB/Shodan/WhoisXML context for indicators (uses configured keys).
Run →
💾 Enrichment → Local
Backfill country/ASN into indicators from existing enrichment JSON.
Run →
Analysis
🔗 Correlate Infrastructure
Find indicators sharing ASN, netblock, registrar or nameserver.
Run →
📈 Score Country Risk
Recompute the composite country-risk index and snapshot it for trends.
Run →
🤖 Summarise (Copilot)
Ask the analyst copilot to summarise any IoC, country or term from local intel.
Run →
🧩 Threat Hunt
Query the estate for patterns, clusters and outliers.
Run →
Collection
📡 DNS Audit
Resolve + record live DNS/reverse-DNS for domains and IPs.
Run →
↻ Auto-Collect Feeds
Pull every enabled feed in the registry and ingest new IoCs.
Run →
🌐 Sync Intel Domains
Refresh UNHCR + World Bank human-security/governance data.
Run →
🔌 Seed Sources
Register 100+ curated authoritative feeds/APIs into the registry.
Run →
Output
📄 Generate Report
Produce a shareable report for a domain or investigation.
Run →
📤 Export STIX/MISP
Package indicators as STIX 2.1 / MISP / CSV for sharing.
Run →
🔐 Detection Rules
Generate YARA / Sigma / Snort rules from indicators.
Run →
Automation
🔔 Run Alert Rules
Evaluate alert rules (incl. country-risk) and raise alerts.
Run →
⚙ Automation Pipeline
The full unattended pipeline (collect→ingest→resolve→enrich→score→alert).
Run →
Skills are deterministic, auditable routines — no black box. Chain them unattended via the
automation pipeline (cron).
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚙ Automation
Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php