ioc-tracker

Correlate indicators of compromise across multiple hosts from CSV data.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/mgreen27/dfir-skills --skill ioc-tracker
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ioc-tracker
Source: https://github.com/mgreen27/dfir-skills/tree/main/skills/ioc-tracker
Command: npx skills add https://github.com/mgreen27/dfir-skills --skill ioc-tracker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill consolidates and monitors Indicators of Compromise across multiple hosts within a single investigation, enhancing visibility into adversary activity.

Core Features & Use Cases

  • Indicator Collection: Tracks filenames, hashes, IP addresses, and registry paths across hosts.
  • Cross-Host Correlation: Compares and promotes critical indicators between systems to identify related malicious activity.
  • Use Case: An analyst finds suspicious process hashes on one machine and promotes them to the cross-host tracker to verify their presence elsewhere in the environment.

Quick Start

Use the ioc-tracker skill to add relevant artifacts from the current investigation and compare indicators across hosts to identify correlated malicious activity.

Frequently Asked Questions about ioc-tracker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I track indicators of compromise across multiple hosts during incident response?

To track indicators of compromise across multiple hosts, you can collect and correlate artifacts like filenames, hashes, and IP addresses to identify related malicious activity within an investigation.

Can I import CSV indicator data to check for malicious activity on other machines?

Yes, you can process CSV indicator data to update cross-host reference records, allowing you to evaluate the presence of suspicious artifacts on other machines in the environment.

What types of artifacts can I correlate for cross-host threat tracking?

Cross-host threat tracking supports correlating filenames, hashes, IP addresses, and registry paths across systems to ensure comprehensive adversary awareness during incident response.

How do I promote suspicious process hashes found on one machine to check other systems?

You can promote suspicious process hashes from a single machine to the cross-host tracker to verify their presence elsewhere, ensuring a coordinated incident response effort across the environment.

Does cross-host indicator correlation enrich findings for better adversary understanding?

Yes, cross-host indicator correlation enriches findings by comparing and promoting critical indicators between systems, which enhances overall visibility into adversary activity and threat awareness.