Pivot on an IOC to discover related GTI entities and relationships.
npx skills add https://github.com/dandye/ai-runbooks --skill pivot-on-ioc
Please help me install this Agent Skill. Skill: pivot-on-ioc Source: https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc Command: npx skills add https://github.com/dandye/ai-runbooks --skill pivot-on-ioc
Pivot on an IOC within Google Threat Intelligence (GTI) to quickly identify related entities and context, enabling faster expansion of security investigations beyond a single indicator.
Provide IOC_VALUE, IOC_TYPE, and RELATIONSHIP_NAMES to initiate the pivot and retrieve related entities.
High-intent search queries and answers about installing and using this skill.
To pivot on an IOC, provide the indicator value, type, and desired relationship names to retrieve connected domains, IPs, files, threat actors, and campaigns from Google Threat Intelligence for expanded security investigations.
Threat intelligence investigations can be expanded using multiple IOC types, including IPs, domains, file hashes, URLs, and collections to surface connected entities and diverse threat context.
Discover related threat actors and campaigns by pivoting on a file hash or domain to query Google Threat Intelligence relationships, which returns a structured result set of connected entities.
Yes, you can use Google Threat Intelligence to find connected IPs and domains by pivoting on a specific URL, which reveals associated entities and threat context for downstream analysis.
Starting a threat intelligence pivot requires three explicit inputs: the IOC value, the IOC type, and the relationship names, which together initiate the query and retrieve a structured set of related entities.
dapperdiversGenerate daily security briefings from OpenCTI, RSS, and CVE intelligence inputs.
Liberty91LTDQuery VirusTotal for IP, domain, hash, and URL reputation reports.
dandyeAggregate GTI reports, SIEM findings, and related entities for a single IOC.
omakeiBuild reusable AdonisJS Lucid query logic with model scopes and query objects.
