ioc-investigation

To investigate an IoC, this skill normalizes the input and executes parallel queries across Defender Threat Intelligence and Sentinel Threat Intel tables to enrich the indicator and identify affected assets.

Yes, KQL advanced hunting results are integrated to perform CVE correlation and device enumeration, mapping affected assets to assess organizational exposure during the threat intelligence investigation.

Automating threat intelligence enrichment is handled by normalizing various IoC types like IPs, domains, URLs, and hashes, then running parallel data collection across Defender and Sentinel sources to gather context.

Yes, domain extraction from URLs is performed automatically during the input normalization phase, ensuring that both full URLs and their underlying domains are checked against threat intelligence tables.

You can export structured threat intelligence reports by generating a JSON file output after the parallel queries and CVE correlations complete, supporting downstream security incident remediation workflows.