ioc-investigation

Investigate IoCs across Defender and Sentinel sources and export JSON reports.

231|64|Updated Dec 16, 2025

Search Tags:#automation #investigation #sentinel #threat-intelligence #kql #ioc #defender

Ready to run

npx skills add https://github.com/SCStelz/security-investigator --skill ioc-investigation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ioc-investigation
Source: https://github.com/SCStelz/security-investigator/tree/main/.github/skills/ioc-investigation
Command: npx skills add https://github.com/SCStelz/security-investigator --skill ioc-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates comprehensive IoC investigations, linking indicators with Defender Threat Intelligence, Sentinel TI tables, advanced hunting results, and CVE correlations to assess organizational exposure.

Core Features & Use Cases

Parallel threat intelligence collection across Defender and Sentinel sources for rapid IoC enrichment.
IoC type normalization and extraction (IP, domain, URL, hash) with domain extraction from URLs.
CVE correlation and device enumeration to map affected assets and exposure.
JSON export and structured reporting to support security incident reviews.

Quick Start

Ask the system to "Investigate IoC 203.0.113.42" or "Check threat intel for domain example.com" and the skill will run parallel data sources, perform CVE correlation, and export a JSON report.

Frequently Asked Questions about ioc-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate an IoC across Defender and Sentinel threat intelligence?▼

To investigate an IoC, this skill normalizes the input and executes parallel queries across Defender Threat Intelligence and Sentinel Threat Intel tables to enrich the indicator and identify affected assets.

Can I use KQL advanced hunting to correlate CVEs with compromised devices?▼

Yes, KQL advanced hunting results are integrated to perform CVE correlation and device enumeration, mapping affected assets to assess organizational exposure during the threat intelligence investigation.

What is the best way to automate threat intelligence enrichment for IPs, domains, and hashes?▼

Automating threat intelligence enrichment is handled by normalizing various IoC types like IPs, domains, URLs, and hashes, then running parallel data collection across Defender and Sentinel sources to gather context.

Does the IoC investigation skill extract domains from URLs automatically?▼

Yes, domain extraction from URLs is performed automatically during the input normalization phase, ensuring that both full URLs and their underlying domains are checked against threat intelligence tables.

How do I export structured threat intelligence reports for incident review?▼

You can export structured threat intelligence reports by generating a JSON file output after the parallel queries and CVE correlations complete, supporting downstream security incident remediation workflows.