--- name: OSINT Threat Intelligence slug: osint-threat-intelligence category: AI Engineering description: OSINT Threat Intelligence gathers live security data for CVEs, breaches, exposed assets, threat actors, and security news. Use it when you need current threat intelligence instead of relying on model memory. github: "https://github.com/apify/awesome-skills/tree/main/skills/apify-osint-threat-intel" language: Python stars: 248 forks: 61 install: "npx degit https://github.com/apify/awesome-skills/tree/main/skills/apify-osint-threat-intel ~/.claude/skills/apify-osint-threat-intel" installs_to: ~/.claude/skills/apify-osint-threat-intel source_path: skills/apify-osint-threat-intel/SKILL.md collection_size: 14 category_size: 2631 collection_url: "https://dirskills.com/collections/apify/awesome-skills" added: 2026-09-02T05:21:13.895Z last_synced: 2026-09-02T05:21:13.895Z canonical_url: "https://dirskills.com/skills/osint-threat-intelligence" --- # OSINT Threat Intelligence OSINT Threat Intelligence gathers live security data for CVEs, breaches, exposed assets, threat actors, and security news. Use it when you need current threat intelligence instead of relying on model memory. **Install:** ```bash npx degit https://github.com/apify/awesome-skills/tree/main/skills/apify-osint-threat-intel ~/.claude/skills/apify-osint-threat-intel ``` ## README # OSINT Threat Intelligence Real-time security intelligence powered by live threat data via Apify actors. **Never answer security questions from training knowledge alone.** CVEs, breaches, and threat actor activity change daily — always gather live data first, then analyze. --- ## Prerequisites - Apify CLI v1.5.0+: `npm i -g apify-cli` - Authenticated: `apify login` or `export APIFY_TOKEN=your_token` - Token: https://console.apify.com/settings/integrations ### CLI rules (always follow) Always pass `--user-agent apify-awesome-skills/apify-osint-threat-intel` on every `apify` CLI call — it's critical for telemetry, never omit it. ```bash apify actors call "ACTOR_ID" -i 'INPUT_JSON' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null apify datasets get-items DATASET_ID --format json --user-agent apify-awesome-skills/apify-osint-threat-intel > /tmp/results.json 2>/dev/null jq '.[] | "\(.field1) | \(.field2)"' /tmp/results.json apify actors info "ACTOR_ID" --input --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # check schema ``` --- ## Actor Routing Table | Data Need | Actor ID | Notes | |---|---|---| | CVE lookup | `apify/google-search-scraper` | Query: `site:nvd.nist.gov [product] [version]` | | NVD full record | `apify/website-content-crawler` | URL: `nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX` | | CISA known exploited | `apify/rag-web-browser` | URL: `cisa.gov/known-exploited-vulnerabilities-catalog` | | GitHub advisories | `apify/rag-web-browser` | URL: `github.com/advisories?query=[product]` | | Exploit-DB search | `apify/google-search-scraper` | Query: `site:exploit-db.com [product] [version]` | | Security news | `data_xplorer/google-news-scraper-fast` | Keywords: `"[target]" vulnerability OR exploit OR breach` | | Reddit threat discussion | `trudax/reddit-scraper` | `searchCommunityName`: netsec OR cybersecurity. **Paid rental Actor (~$45/month after free trial)** — warn the user before Reddit steps; every other Actor here is pay-per-use. | | Threat intel Twitter/X | `apidojo/tweet-scraper` | Keywords: `#threatintel [target]`, search mode | | Breach mention search | `apify/google-search-scraper` | Query: `"[domain]" site:pastebin.com OR intext:breach` | | Vendor security advisory | `apify/website-content-crawler` | Direct vendor security page URL | | Shodan exposure hints | `apify/google-search-scraper` | Query: `site:shodan.io "[domain OR org name]"` | | Threat actor research | `apify/rag-web-browser` | MITRE ATT&CK: `attack.mitre.org/groups/` | **Prefer** `apify/google-search-scraper` and `apify/rag-web-browser` over `website-content-crawler` for speed. **Use** `website-content-crawler` only when you need the full page body (e.g. NVD detail, vendor advisory). **Do NOT** use `website-content-crawler` on: reddit.com, twitter.com, pastebin.com, linkedin.com. --- ## Core Workflow ### Step 0 — Clarify scope before running anything Ask the user: - **Target type**: domain, IP, software/version, CVE ID, threat actor name, or keyword? - **Goal**: one-time lookup vs. ongoing monitoring brief? - **Autonomy**: full autopilot, or checkpoint before each actor call? ### Step 1 — Identify module | User says | Module | Steps | |---|---|---| | "Find CVEs for [product]" | CVE Intelligence | 2a | | "Is [domain] breached / exposed" | Domain Threat Profile | 2b | | "Research [threat actor / malware]" | Threat Actor Profile | 2c | | "Security news about [topic]" | Security News Brief | 2d | | "Attack surface of [company]" | Attack Surface Discovery | 2b + 2d | | "Full threat report on [target]" | Multi-Module | 2a + 2b + 2c + 2d | ### Step 2a — CVE Intelligence Gather live CVE data for a product or version: ```bash # 1. Search NVD via Google apify actors call "apify/google-search-scraper" -i '{ "queries": "site:nvd.nist.gov CVE [PRODUCT] [VERSION]", "maxPagesPerQuery": 1 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 2. Pull full NVD record for each CVE ID found apify actors call "apify/website-content-crawler" -i '{ "startUrls": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX"}], "proxyConfiguration": {"useApifyProxy": true}, "maxCrawlPages": 1 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 3. Check if CVE is in CISA's Known Exploited Vulnerabilities list apify actors call "apify/rag-web-browser" -i '{ "query": "[CVE-ID] site:cisa.gov/known-exploited-vulnerabilities-catalog", "maxResults": 3 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 4. Check Exploit-DB for public PoC apify actors call "apify/google-search-scraper" -i '{ "queries": "site:exploit-db.com [PRODUCT] [VERSION]", "maxPagesPerQuery": 1 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null ``` Synthesize: severity (CVSS), exploitability (CISA KEV = active exploitation), public PoC exists (yes/no), patch available (yes/no). ### Step 2b — Domain Threat Profile ```bash # 1. Search for breach mentions apify actors call "apify/google-search-scraper" -i '{ "queries": "\"[DOMAIN]\" breach OR leak OR hacked OR \"data exposed\"", "maxPagesPerQuery": 1 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 2. Check paste sites for credential leaks apify actors call "apify/google-search-scraper" -i '{ "queries": "\"[DOMAIN]\" site:pastebin.com OR site:ghostbin.com OR site:rentry.co", "maxPagesPerQuery": 1 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 3. Check Shodan exposure hints via Google apify actors call "apify/google-search-scraper" -i '{ "queries": "site:shodan.io \"[DOMAIN OR ORG]\"", "maxPagesPerQuery": 1 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 4. Scan r/netsec and r/cybersecurity for mentions apify actors call "trudax/reddit-scraper" -i '{ "searches": ["[DOMAIN] breach", "[DOMAIN] hack", "[DOMAIN] vulnerability"], "searchCommunityName": "netsec", "maxPostCount": 10, "proxy": {"useApifyProxy": true} }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null ``` ### Step 2c — Threat Actor Profile ```bash # 1. MITRE ATT&CK lookup apify actors call "apify/rag-web-browser" -i '{ "query": "[THREAT ACTOR NAME] site:attack.mitre.org", "maxResults": 3 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 2. Recent activity via news apify actors call "data_xplorer/google-news-scraper-fast" -i '{ "keywords": ["[THREAT ACTOR NAME] attack OR campaign OR malware"], "maxArticles": 15 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 3. Community threat intel on Twitter/X apify actors call "apidojo/tweet-scraper" -i '{ "searchTerms": ["#threatintel [THREAT ACTOR]", "[THREAT ACTOR] TTPs"], "maxItems": 20, "sort": "Latest" }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 4. Reddit discussion apify actors call "trudax/reddit-scraper" -i '{ "searches": ["[THREAT ACTOR NAME]"], "searchCommunityName": "netsec", "maxPostCount": 10, "proxy": {"useApifyProxy": true} }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null ``` ### Step 2d — Security News Brief ```bash # 1. Google News for topic apify actors call "data_xplorer/google-news-scraper-fast" -i '{ "keywords": ["[TOPIC] vulnerability OR CVE OR breach OR exploit"], "maxArticles": 20 }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null # 2. Reddit r/netsec latest apify actors call "trudax/reddit-scraper" -i '{ "startUrls": [{"url": "https://www.reddit.com/r/netsec/"}], "maxPostCount": 15, "sort": "new", "proxy": {"useApifyProxy": true} }' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null ``` ### Step 3 — Triage and assess For every finding, apply this classification: | Severity | Criteria | |---|---| | **Critical** | CVSS ≥ 9.0 OR on CISA KEV list OR public PoC + unpatched | | **High** | CVSS 7.0–8.9 OR active exploitation reported in news | | **Medium** | CVSS 4.0–6.9 OR breach mention without active exploit | | **Low** | CVSS < 4.0 OR historical, patched, no active exploitation | | **Informational** | Exposure hints without confirmed vulnerability | ### Step 4 — Deliver structured report Output format: ``` ## Threat Intelligence Report — [TARGET] Date: [today] ### Executive Summary [2–3 sentence risk verdict] ### Critical Findings - [CVE/Finding] — Severity: [X] — Status: [Patched/Unpatched/Active exploit] Source: [URL] ### Breach/Exposure Indicators - [Finding] — Source: [URL] ### Threat Actor Activity (if applicable) - [Actor] — TTPs: [list] — Last seen: [date] ### Recommended Actions 1. [Immediate action] 2. [Short-term action] 3. [Monitoring recommendation] ### Data Sources [Bullet list of all URLs cited] ``` --- ## Data Quality Rules - **Every claim needs a source URL** — no ungrounded assertions - **Empty results are intelligence** — report them explicitly ("no paste mentions found") - **Date-stamp all findings** — CVE severity, patch status, and breach reports are time-sensitive - **Confidence tiers**: - `[Confirmed]` — primary source (NVD, CISA, vendor advisory) - `[Reported]` — news + community corroboration - `[Unverified]` — single secondary source, flag clearly - **Parallelize** independent actor calls (CVE search + news + Reddit can run simultaneously) - **Budget**: warn user if >10 actor calls needed; get approval before proceeding --- ## Troubleshooting | Problem | Fix | |---|---| | `google-search-scraper` returns 0 results | Simplify query, remove `site:` filter, try broader terms | | `website-content-crawler` times out on NVD | Use `rag-web-browser` as fallback with direct CVE URL | | `trudax/reddit-scraper` returns empty | Try `harshmaur/reddit-scraper` as fallback | | `tweet-scraper` returns sparse results | Broaden to `#cybersecurity [term]` or drop hashtag requirement | | CISA KEV page too large to crawl | Use `rag-web-browser` with specific CVE ID as query | --- ## Example prompts - "Check if example.com has any known vulnerabilities or appears in recent breach data." - "What's the latest threat intel on CVE-2026-1234 — is it actively exploited?" - "Profile the APT28 group — recent campaigns, TTPs, and infrastructure." **Boundary:** This skill researches organizations, infrastructure and named threat *groups*. It won't build cross-platform profiles of private individuals.