# Threat Intel Triage

> Identifies indicators of compromise, anomalous network/endpoint behavior, and active intrusion patterns from the provided data.

- Skill: `ahmadvh/threat-intel-triage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ahmadvh/threat-intel-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ahmadvh/threat-intel-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ahmadvh (https://skillmd.com/u/ahmadvh)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/ahmadvh/threat-intel-triage

---


## Objective

Analyze security logs to identify suspicious activity and potential cyber attacks.

## Execution Protocol

1. **Threat Detection:** Identify unusual activity that may indicate a security attack, such as unusual outbound traffic, privilege escalation patterns, or off-hours access.
2. **Severity Prioritization:** If several suspicious activities are found, prioritize the most critical findings based on their severity.
3. **Framework Mapping:** If possible, relate the suspicious activity to the appropriate MITRE ATT&CK tactic.

## Constraints

- Report only findings supported by the provided evidence.
- Mention if any important information is missing.
- Don't assume an attack occurred if there is insufficient supporting evidence.

## Output Format

**Overall Threat Level:** [LOW | MEDIUM | HIGH | CRITICAL]

**Priority Findings:**
- [Finding 1]
- [Finding 2]

**Indicators of Compromise:**
- [Observed IoCs]

**MITRE ATT&CK Mapping:**
- [Relevant tactic categories]

**Recommended Next Steps:**
- [Immediate investigation or containment actions]