Back to catalog / Agent workflows
Turn multi-source IOC lookups into a threat-intelligence brief
Query simulated intelligence sources for synthetic IP/hash/domain indicators, correlate findings, and produce a sourced draft.
Goal
Organize an analyst’s read-only threat-intelligence queries without acting on indicators.
Steps
- Prepare synthetic IOC examples and define explicit inputs and source fields for each simulated tool. [threat]
- Let Claude select VirusTotal/AbuseIPDB/MITRE-like tools by indicator type and process their
tool_use/tool_resultloop. [threat] - Report indicator, source, time, corroboration/conflict, and confidence limits for analyst review. [threat]
How to verify
Every lookup traces to a simulated tool; the report labels mock data and unknowns clearly.
Troubleshooting
When sources conflict, present both and escalate; an unknown indicator is not evidence of safety.
Permissions
Prerequisites
- Python, Anthropic SDK, API key, and synthetic IOC fixtures.
Permissions
- Use no real credentials or organizational telemetry; separately audit licensing and access before using real sources.
Limitations
Notebook backends are simulated, not threat facts; do not auto-block IPs, run samples, or call paid services.
Pinned upstream source
- Repository
- anthropics/anthropic-cookbook
- File path
- tool_use/threat_intel_enrichment_agent.ipynb
- Pinned commit
9c1e493ddd2b82df399d2a61b9c806c539e18be6- Source checked
- 2026-10-14 · Reviewed against the pinned upstream source
Repository metrics
These values describe the upstream repository, not popularity or likes for an individual skill or playbook.
- Stars
- Not collected
- Forks
- Not collected
- Observed at
- Not collected
No metrics snapshot is available yet.
License: MIT
Main topic
Make Agent behavior safer and easier to verify