Aggregate GTI reports, SIEM findings, and related entities for a single IOC.
npx skills add https://github.com/dandye/ai-runbooks --skill deep-dive-ioc
Please help me install this Agent Skill. Skill: deep-dive-ioc Source: https://github.com/dandye/ai-runbooks/tree/main/skills/deep-dive-ioc Command: npx skills add https://github.com/dandye/ai-runbooks --skill deep-dive-ioc
Exhaustive analysis of a potentially critical IOC escalated from Tier 1, enabling deeper threat context, GTI pivoting, and SIEM correlation to drive informed decisions.
Provide IOC_VALUE and IOC_TYPE to initiate the deep-dive IOC analysis and compile GTI pivot data, SIEM context, and threat attribution.
High-intent search queries and answers about installing and using this skill.
Deep-dive IOC analysis aggregates GTI reports, SIEM findings, and related entities to identify full threat context for a single escalated indicator. You provide an IOC value and type to initiate comprehensive threat intelligence enrichment and SIEM correlation.
Threat attribution identifies the actors behind an indicator by pivoting through Google Threat Intelligence relationships. It aggregates related entities and GTI reports to provide comprehensive threat context for a single IOC requiring investigation.
Yes, you can use SIEM searches to correlate an IOC with related entities and behaviors. The analysis performs deep SIEM searches to gather, correlate, and report findings for informed incident response decisions.
Yes, you need access to GTI MCP, SIEM search tools, and enrichment capabilities to investigate escalated IOCs. These tools gather, correlate, and report comprehensive threat context and related entity findings.
The best way to aggregate threat intelligence for a single critical indicator is to combine GTI pivoting with SIEM enrichment. This approach correlates related entities and behaviors to drive informed incident response decisions.
dandyeEnrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.
wyre-technologyInvestigate and remediate Abnormal Security email threats like BEC and phishing.
dandyeIntegrate threat actor profiles and intelligence to locate and report on IoCs and MITRE techniques in real-time network traffic.
jmaglyExtracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.
