Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.
npx skills add https://github.com/dandye/ai-runbooks --skill enrich-ioc
Please help me install this Agent Skill. Skill: enrich-ioc Source: https://github.com/dandye/ai-runbooks/tree/main/skills/enrich-ioc Command: npx skills add https://github.com/dandye/ai-runbooks --skill enrich-ioc
Enrich IOC indicators with GTI and Chronicle SIEM context to produce threat intelligence findings and contextual summaries.
Enrich an IOC value using GTI and Chronicle SIEM to return threat intel findings, SIEM entity summary, and IOC match status.
High-intent search queries and answers about installing and using this skill.
To enrich IOCs with threat intelligence, you can use automated tools to query GTI and Chronicle SIEM for indicators like IPs, domains, and file hashes. This process surfaces reputation data, first and last seen timestamps, and related alerts to determine the threat posture.
Checking if an indicator exists in threat feeds involves assessing IOC match status against threat intelligence databases. This mechanism generates a THREAT_SCORE and MALICIOUS_CONFIDENCE rating to help determine the indicator's overall threat posture.
Yes, you can use Chronicle SIEM entity lookup for a suspicious domain to attach first and last seen timestamps, related alerts, and associated assets. This provides a contextual summary of the indicator's activity within your environment.
GTI enrichment works for file hashes and URLs to surface reputation and contextual context. It assesses IOC matches to generate a MALICIOUS_CONFIDENCE rating, determining the threat posture of these indicators during investigations.
Enriching indicators with both GTI and SIEM context is needed to combine external threat reputation with internal network visibility. GTI provides global threat findings while the SIEM summary attaches local alerts and asset relationships.
woohyun212Extract IPs, domains, URLs, emails, and file hashes from text, logs, or URLs.
zenobi-usCoordinate incident response for security breaches and operational incidents.
aviskaarConduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.
Muath2000Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.
