Threat intelligence workflow workshop
Instructor-led workshop materials for investigating a threat scenario with Claude Code and the Team Cymru Scout API and MCP.
These are the student materials for an instructor-led workshop at The Underground Economy Conference 2026. Participants use Claude Code and the Team Cymru Scout API and MCP to investigate a threat scenario, package the method they used as a reusable skill, and direct a team of agents that checks its own work.
A preflight script checks the setup on macOS, Linux, or Windows before the session. It installs dependencies, runs a build, and includes a path to confirm Scout. During the workshop, the investigation is written to a report and a findings file. A later part of the session uses that investigation to build the agent team, which writes a threat report back into the same repository.
The materials include a Team Cymru Scout API specification and an environment cheat sheet. The repository is the working copy for the workshop. It is not a published threat-intelligence service.