skills.rest
jassics
jassicsCOMMUNITY
Explore all skills by this author →
Website𝕏@jassicsGitHub

ioc-enrichment

Enrich indicators of compromise with context, relationships, and confidence assessment.

6|Updated May 30, 2026
Search Tags:#security analysis#incident response#threat intelligence#IOC#enrichment
One-click install
npx skills add https://github.com/jassics/awesome-claude-security --skill ioc-enrichment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ioc-enrichment
Source: https://github.com/jassics/awesome-claude-security/tree/main/plugins/threat-intelligence/skills/ioc-enrichment
Command: npx skills add https://github.com/jassics/awesome-claude-security --skill ioc-enrichment

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill turns raw indicators of compromise (IOCs) into actionable insights, providing context, relationships, and a decision on whether to block or monitor.

Core Features & Use Cases

  • Enrichment: Resolve context, infrastructure, and relationships for IOCs.
  • Assessment: Assess confidence and relevance of IOCs.
  • Action: Decide on blocking, monitoring, or ignoring IOCs.
  • Use Case: For incident response, enrich IOCs from a feed or hunt to determine the appropriate defensive action.

Quick Start

Use the ioc-enrichment skill to analyze an IOC and decide on an action.

Frequently Asked Questions about ioc-enrichment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enrich indicators of compromise for incident response context?▼

IOC enrichment resolves context, infrastructure, and relationships for indicators of compromise to provide actionable insights for defensive actions like blocking or monitoring during incident response.

What is the best way to assess confidence and relevance of threat intelligence IOCs?▼

Assessing confidence and relevance of threat intelligence IOCs involves resolving their context and relationships to determine whether to block, monitor, or ignore them in your defensive workflows.

Can I use this skill to decide whether to block or monitor an IOC from a threat feed?▼

Yes, you can use this skill to analyze IOCs from a feed or hunt, assess their confidence and context, and decide on the appropriate defensive action such as blocking or monitoring.

How does IOC enrichment determine relationships between indicators of compromise?▼

IOC enrichment determines relationships by analyzing the indicators of compromise, resolving their underlying infrastructure and context, and assessing connections to build a complete picture for defensive decision-making.

When do I need to enrich IOCs during a threat hunt?▼

You need to enrich IOCs during a threat hunt when raw indicators require context, relationship mapping, and confidence assessment to determine whether blocking, monitoring, or ignoring is the appropriate defensive action.

Related Skills

GhostPWNGhostPWN
4

Threat Hunting & IOC Analysis

Extract and normalize indicators of compromise from threat reports.

Official
Advanced
leonardoteodorooleonardoteodoroo

threat-mitigation-mapping

Map detected threats to applicable security controls across network, application, data, and endpoint layers.

Community
Advanced
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced