Parse IOC lists, query SIEMs, and enrich matched indicators.
npx skills add https://github.com/dandye/ai-runbooks --skill hunt-ioc
Please help me install this Agent Skill. Skill: hunt-ioc Source: https://github.com/dandye/ai-runbooks/tree/main/skills/hunt-ioc Command: npx skills add https://github.com/dandye/ai-runbooks --skill hunt-ioc
It helps security teams quickly locate Indicators of Compromise (IOCs) across their environment by querying SIEM data, threat intel feeds, and related sources, enabling faster detection and response.
Provide a comma-separated list of IOCs and their types, then run the hunt to locate matches and generate enrichment.
High-intent search queries and answers about installing and using this skill.
You can hunt Indicators of Compromise by providing a comma-separated list of IOCs, which triggers iterative SIEM searches using tailored UDM queries per IOC type to locate matches.
IOC enrichment is performed using entity lookups after SIEM searches, generating standardized result documentation to support case management and accelerate incident response.
Yes, the system supports parsing and validating mixed IOC types, including IPs, domains, hashes, and URLs, from a single user-provided list before executing iterative queries.
Threat intelligence feeds are queried alongside SIEM data to help determine IOC relevance, allowing you to cross-reference provided indicators against known threats and internal logs.
Threat hunting handles different formats by parsing IOC types and applying tailored UDM queries iteratively, ensuring each indicator type is searched correctly within the SIEM.
SCStelzInvestigate IoCs across Defender and Sentinel sources and export JSON reports.
alexmarucciAutomate incident detection, tracking, escalation, resolution, and post-mortem analysis via Datadog API.
dandyeEnrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.
aviskaarConduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.
