asp-artifact-zh

You search artifacts by matching IOC values across attributes like value, type, role, owner, and reputation to quickly locate existing records during incident investigations.

You create a new artifact record when an IOC search returns no matches, then attach that artifact to the relevant alert to support ongoing incident investigations.

Yes, you can persist investigation notes and structured analysis as enrichments linked to artifacts, ensuring follow-up reviewers have immediate access to prior context.

You attach artifacts to alerts to link IOC records directly to the alert timeline, providing analysts with quick pivot points and sustained context during incident response.

Pivot around artifacts using value, type, role, owner, or reputation fields, enabling flexible lookups that support varied investigation workflows and alert enrichment.

No, this artifact enrichment workflow operates without external dependencies, integrating natively with the asp enrichment workflow to support list, create, and attach commands.