Skill This
AI Skill Report Card

Generating Threat Intel Reports

A-85·Jul 31, 2026·Source: Web
Markdown
---
name: generating-threat-intel-reports
description: Generates daily HTML cyber threat intelligence and exposure reports by correlating Cloudflare MCP threat data (APT infrastructure, IOCs, DDoS, campaigns) with optional F5 BIG-IP perimeter logs and Cortex XSIAM xdr_data telemetry. Use when asked to produce a daily threat briefing, prioritize IOCs for blocking, assess whether global threats reached the organization's perimeter/endpoints, detect webshells, or export indicators for XSIAM/Sigma/Suricata ingestion.
---

# Generating Threat Intel Reports
Quick Start14 / 15

Minimal viable pipeline (Cloudflare-only), extendable with F5/XSIAM later:

Bash
python 01_collect_cloudflare.py --since 24h --out data/cloudflare.json
python 04_correlate.py --cloudflare data/cloudflare.json --out data/correlated.json
python 05_generate_html.py --in data/correlated.json --out reports/daily-threat-report-$(date +%F).html
python 06_export_iocs.py --in data/correlated.json --out-dir exports/

Open reports/daily-threat-report-<date>.html in a browser. If F5/XSIAM sources are unavailable, the report degrades gracefully — sections that need them show "Data source not connected" instead of failing.

Recommendation▾
The document cuts off mid-sentence in Common Pitfalls ('Don't generate export files... for indicators with') — fix the truncation to complete the thought and avoid appearing broken.
Workflow15 / 15

Progress checklist for building/running the skill end-to-end:

  • Step 1: Collect Cloudflare MCP data (threat events, IOCs, DDoS, campaigns, IP/URL/ASN reputation, Radar)
  • Step 2: (Optional) Collect F5 BIG-IP perimeter logs (requests, WAF, JA3/JA4, HTTP status codes)
  • Step 3: (Optional) Query XSIAM xdr_data for endpoint/identity/network corroboration
  • Step 4: Correlate across sources, dedupe IOCs, compute scores
  • Step 5: Generate HTML dashboard
  • Step 6: Export IOC feeds (CSV, Sigma, Suricata, YARA, XSIAM JSON)
  • Step 7: Deliver report (email/Slack/Teams) and archive

Step 1 — Collect Cloudflare data

Query via MCP tools for the last 24h:

  • Threat events (with MITRE TTP mappings, regions, verticals)
  • Top source IPs, ASNs, JA3/JA4 fingerprints, domains, URLs, SHA hashes
  • IP/domain/URL reputation lookups for all observed indicators
  • Active threat actor campaigns (APT, cybercrime, ransomware clusters)
  • DDoS activity (bps/pps, vectors, protocols, geographic source/target)
  • Radar trends (compare today vs yesterday/last week/last month)
  • Explicitly query for novel/first-seen events: "threat events observed in the last 24h not seen in the prior 30 days"

Persist raw results as JSON — never discard the source payload, only summarize on top of it.

Step 2 — Collect F5 (if available)

Pull HTTP/TLS logs (iControl REST, Telemetry Streaming, or exported to XSIAM):

  • Request URI, method, HTTP status code, JA3/JA4, source IP, user-agent
  • WAF block/allow decisions
  • Flag suspicious upload patterns (.php, .aspx, .jsp, .ashx, /upload*) and suspicious params (cmd=, exec=, system=)

Step 3 — Collect XSIAM xdr_data (if available)

For every Cloudflare IOC, check presence in:

  • Endpoint telemetry (process trees — especially web server → shell → PowerShell/bash chains)
  • Identity/VPN/SSO logs (auth events, impossible travel, risk users)
  • DNS/proxy/firewall logs
  • Alerts/incidents already opened referencing the IOC

Step 4 — Correlate

For each IOC, build a presence matrix: Cloudflare | F5 | XSIAM. Compute:

  • Threat Exposure Score = f(IOCs seen at perimeter, IOCs reaching backend with 2xx, IOCs with endpoint activity)
  • Active Compromise Score = f(execution, persistence, exfiltration signals)
  • Webshell Probability = f(successful upload + 200 response + file creation + web-server child process + outbound connection + known IOC + matching MITRE TTP)
  • Reconstruct a cross-source timeline (Cloudflare detection → F5 request → F5 verdict → backend response → XSIAM process/auth events)

Only IOCs that appear in ≥2 sources or have high native Cloudflare confidence should reach "Immediate Block" — this keeps the list actionable instead of listing thousands of global IOCs.

Step 5 — Generate HTML

Single self-contained HTML file (inline CSS/JS, Chart.js via CDN or vendored), dark theme, sortable/filterable tables (DataTables or vanilla JS), print/PDF-friendly. See Report Structure below.

Step 6 — Export IOCs

Generate in exports/:

  • iocs.csv, blocklist.txt
  • suricata.rules, sigma.yml, YARA (if hash-based webshell/malware detected)
  • xsiam_indicators.json (ready for direct ingestion)
  • Suggested XQL hunting queries as a .xql or markdown block

Step 7 — Deliver

Send via email/Slack/Teams webhook, archive under reports/archive/YYYY-MM-DD/.

Recommendation▾
Add a concrete example of a full HTML report snippet or JSON correlation output structure to strengthen the Examples section with actual data shapes, not just prose descriptions.
Report Structure (HTML sections, in order)
  1. Header — date, overall threat level (🟢/🟡/🔴), Threat Exposure Score, Active Compromise Score
  2. Executive Summary — 1 paragraph, LLM-written, plain language, no jargon dump
  3. Threat Events Overview — totals by severity, top countries, top victim industries, top attack types, timeline chart
  4. Top Attackers — top 20 source IPs/ASNs/countries with campaign attribution
  5. Reputation Deep-Dive — answers "Are any of these IPs known malicious?" per top-5 IP with botnet/APT/scanner/C2/DDoS flags and confidence
  6. IOC Prioritization Table — IOC | Type | Score | Seen | Sources (CF/F5/XSIAM) | Recommended Action
  7. Threat Actor Intelligence — per-actor cards (activity, infrastructure, targets, TTPs, MITRE IDs, expected evolution) — only include actors with actual events today
  8. Novel/Emerging Threats — first-seen-in-24h events with why-it-matters, detection, mitigation
  9. MITRE ATT&CK Coverage — tactic-by-tactic % of observed events
  10. DDoS Summary — largest attacks, vectors, geo heatmap, trend deltas
  11. Perimeter Exposure (if F5 connected) — malicious IPs that reached backend, HTTP status outcomes, top targeted URIs/apps
  12. Endpoint/Identity Corroboration (if XSIAM connected) — IOC-to-endpoint matches, auth anomalies, process execution chains, incident links
  13. Webshell Detection (if F5+XSIAM connected) — probability score, evidence chain, affected hosts
  14. Reconstructed Timeline — cross-source kill-chain view for any IOC with ≥2-source correlation
  15. Recommended Actions — prioritized (P1/P2/P3), each with reason + confidence
  16. Hunting & Detection Content — suggested XQL, Sigma, Suricata, YARA, WAF rules
  17. IOC Export Footer — links/paths to generated CSV/JSON/rule files
Examples16 / 20

Example 1: Input: Cloudflare MCP returns an IP (198.51.100.10) tagged as active C2, score 99, associated with FIN7. Output: Row in Immediate Block table: 198.51.100.10 | IP | 99 | Today | Block. Recommended Actions P1: "Block 198.51.100.10 — Reason: Active C2 infrastructure (FIN7) — Confidence: 99%."

Example 2: Input: Cloudflare flags IOC as high-confidence; F5 logs show same IP hit /upload.aspx with HTTP 200; XSIAM shows w3wp.exe → cmd.exe → powershell.exe 60 seconds later on the matching host. Output: Webshell Detection section set to CRITICAL, with full timeline table (08:13 CF detection → 08:21 F5 request → 08:22 200 OK → 08:23 file created → 08:24 w3wp.exe spawns powershell.exe), MITRE T1505.003 + T1190 + T1059 tagged, and Recommended Actions: isolate host, hunt SHA256 org-wide, block IP/domain, patch exploited CVE.

Example 3: Input: No F5/XSIAM MCP configured, only Cloudflare. Output: Report generates normally through section 10 (DDoS Summary); sections 11–14 render a placeholder: "Perimeter/endpoint correlation unavailable — connect F5/XSIAM MCP to enable this section." Report is still fully usable as a standalone Threat Intelligence Daily Briefing.

Recommendation▾
Consider adding a troubleshooting section for common MCP query failures (e.g., rate limits, auth errors, empty Cloudflare responses) since the pipeline depends on external integrations.
Best Practices
  • Always keep raw JSON from each source before summarizing — enables re-running correlation without re-querying MCP.
  • Prioritize ruthlessly. Never dump 50,000 IOCs; the value is in narrowing to the handful that matter (multi-source hits, high confidence, or actually reached the perimeter).
  • Write the Executive Summary last, after all data is collected, so it reflects real numbers, not a template.
  • Treat HTTP status codes as signal. A malicious IP getting 200 OK is categorically more important than the same IP getting 403.
  • Degrade gracefully. Each optional data source (F5, XSIAM) should independently enable/disable report sections — never let a missing integration break the whole report.
  • Make the report self-contained. Inline all CSS/JS or vendor them locally so the HTML opens correctly even offline/air-gapped.
  • Tag every finding with MITRE ATT&CK IDs when available from either Cloudflare or XSIAM — this is what makes the report usable by other analysts.
  • Version and date every report (daily-threat-report-YYYY-MM-DD.html) and keep an archive for trend comparison ("what changed vs yesterday/last week").
  • Cross-reference before calling something "malicious." A single low-confidence source shouldn't drive a Block recommendation — require corroboration or a high native score (≥90).
Common Pitfalls
  • Don't list every raw IOC from Cloudflare without filtering — it overwhelms the SOC and buries what matters.
  • Don't treat DDoS volumetric stats and targeted APT/webshell activity with the same urgency — separate sections, separate scoring.
  • Don't claim compromise based on Cloudflare/F5 data alone — "reached the backend" is not the same as "confirmed compromise"; only XSIAM endpoint evidence justifies that language.
  • Don't hardcode assumptions about which MCP tools exist — check available Cloudflare MCP tool names/schemas first, since they can change.
  • Don't skip deduplication — the same IOC often appears across multiple Cloudflare event types and will inflate counts if not merged by indicator value.
  • Don't generate export files (Sigma/Suricata/YARA) for indicators with
0
Grade A-AI Skill Framework
Scorecard
Criteria Breakdown
Quick Start
14/15
Workflow
15/15
Examples
16/20
Completeness
17/20
Format
14/15
Conciseness
13/15
Save to My Skills