skills.rest
balsm-health
balsm-healthOFFICIAL
Explore all skills by this author →
Website𝕏@balsm_healthGitHub

analyzing-indicators-of-compromise

Analyze and enrich indicators of compromise using VirusTotal, AbuseIPDB, and MISP.

2|Updated Jun 5, 2026
Search Tags:#cybersecurity#security automation#threat intelligence#malware analysis#IOC analysis
One-click install
npx skills add https://github.com/balsm-health/Balsm-AI --skill analyzing-indicators-of-compromise-balsm-health
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: analyzing-indicators-of-compromise
Source: https://github.com/balsm-health/Balsm-AI/tree/main/plugin/skills/analyzing-indicators-of-compromise
Command: npx skills add https://github.com/balsm-health/Balsm-AI --skill analyzing-indicators-of-compromise-balsm-health

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, vt-py, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill analyzes indicators of compromise (IOCs) to determine their maliciousness, assign campaign attribution, and establish blocking priority. It is used for triaging IOCs from phishing emails, security alerts, and external threat feeds.

Core Features & Use Cases

  • IOC Analysis: Analyzes IP addresses, domains, file hashes, URLs, and email artifacts.
  • Multi-Source Intelligence: Enhances IOCs with data from VirusTotal, AbuseIPDB, MalwareBazaar, MISP, and IOC enrichment pipelines.
  • Decision Support: Assists in making block/monitor/whitelist decisions based on confidence scores and enrichment data.

Quick Start

Analyze the IOC 'example.com' for maliciousness and campaign attribution.

Frequently Asked Questions about analyzing-indicators-of-compromise

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze indicators of compromise for maliciousness and campaign attribution?▼

Analyze indicators of compromise by enriching IP addresses, domains, file hashes, and URLs with multiple threat intelligence sources. This process determines maliciousness, assigns campaign attribution, and establishes blocking priority for triaged security artifacts.

What threat intelligence sources can I use to enrich IOCs?▼

You can enrich IOCs using VirusTotal, AbuseIPDB, MalwareBazaar, and MISP. These multi-source intelligence platforms provide the confidence scores and enrichment data needed to support block, monitor, or whitelist decisions.

Do I need API keys to automate IOC analysis for incident response?▼

Yes, you need API keys for VirusTotal, AbuseIPDB, and MISP to automate IOC analysis. These keys allow the enrichment pipeline to query external threat intelligence sources and retrieve maliciousness data.

Can I use Python to triage IOCs from phishing emails and security alerts?▼

Yes, you can use Python with the requests and vt-py libraries to triage IOCs from phishing emails and security alerts. The script analyzes email artifacts and other indicators to determine blocking priority.

What types of IOCs can be analyzed for blocking priority decisions?▼

You can analyze IP addresses, domains, file hashes, URLs, and email artifacts. The analysis applies confidence scores and enrichment data from external threat feeds to assist in making block, monitor, or whitelist decisions.

Does VirusTotal integration work with MISP for malware analysis and threat hunting?▼

Yes, VirusTotal integration works with MISP by using the vt-py library and requests. This multi-source approach enriches malware analysis and threat hunting workflows by correlating IOC data across both platforms.

Related Skills

YukiIto1999YukiIto1999

performing-ioc-enrichment-automation

Automate IOC enrichment across VirusTotal, AbuseIPDB, Shodan, and GreyNoise.

Community
Advanced
YukiIto1999YukiIto1999

conducting-memory-forensics-with-volatility

Analyze RAM dumps with Volatility 3 to extract malware and network evidence.

Community
Advanced
4lerman4lerman

threat-detection

Score hunting hypotheses against MITRE ATT&CK techniques and IOC data.

Community
Advanced
Liberty91LTDLiberty91LTD
15

hash-investigation

Aggregate multi-source threat intel to characterize file hashes and produce pivot-ready output.

Official
Advanced