skills.rest
refractionPOINT
refractionPOINTOFFICIAL
Explore all skills by this author →
WebsiteGitHub

threat-report-evaluation

Evaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.

29|3|Updated Dec 21, 2025
Search Tags:#LCQL#threat intelligence#IOC#threat report#detection rules
One-click install
npx skills add https://github.com/refractionPOINT/lc-ai --skill threat-report-evaluation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-report-evaluation
Source: https://github.com/refractionPOINT/lc-ai/tree/main/marketplace/plugins/lc-essentials/skills/threat-report-evaluation
Command: npx skills add https://github.com/refractionPOINT/lc-ai --skill threat-report-evaluation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill evaluates threat reports to extract IOCs and behaviors, searches for evidence across orgs, and builds LCQL queries, D&R rules, and lookups to drive defense.

Core Features & Use Cases

  • Phase-driven approach: download, parse, hunt IOCs, hunt behaviors
  • Generates LCQL queries and D&R rules per IOC/behavior
  • Focus on data from the report and the target orgs only

Quick Start

Import a threat report URL or text, specify target orgs, and begin IOC extraction and rule generation.

Frequently Asked Questions about threat-report-evaluation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract IOCs from threat reports and hunt them across my organizations?▼

IOC extraction from threat reports identifies indicators like IPs, domains, and file hashes, then searches for evidence across your LimaCharlie orgs. This Skill parses threat reports, generates LCQL queries for each IOC, and runs parallel hunts to detect matches in your environment.

Can I automatically generate D&R rules from threat intelligence reports?▼

Yes. This Skill parses threat reports to extract behaviors and IOCs, then generates LCQL-based detection rules and D&R rules tailored to your orgs. Rules are created from report data only and require your confirmation before deployment.

What's the best way to evaluate breach reports and APT campaign data against my infrastructure?▼

Breach evaluation correlates indicators and tactics from threat reports against your LimaCharlie orgs through parallel IOC and behavior hunts. The Skill extracts provenance-tracked data, generates targeted queries, and delivers rule recommendations for rapid defense deployment.

Do I need to manually parse threat intelligence feeds, or can this automate IOC hunting?▼

This Skill automates the full pipeline: download, parse threat feeds or reports, extract IOCs and behaviors, run hunts across orgs, and generate rules—eliminating manual parsing and enabling coordinated detection at scale.

How do I apply multiple threat reports across different organizations simultaneously?▼

The Skill orchestrates parallel IOC and behavior hunts across single or multiple orgs in a single workflow. Specify target orgs, import threat reports, and it coordinates phased extraction, hunting, rule generation, and deployment across your fleet.

What data sources can I use—just URLs, or do threat report text imports work too?▼

Threat report import accepts both URLs and direct text input. The Skill downloads and parses content, extracts IOCs and behaviors with strict provenance tracking tied to the report and your org, then builds queries and rules from verified data only.

Related Skills

Explore More Data & Analytics Skills→
SherifEldeebSherifEldeeb
5

threat-intelligence

Extract, normalize, and report cyber threat intelligence from unstructured text.

Community
Intermediate
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced
refractionPOINTrefractionPOINT
29

limacharlie-call

Execute LimaCharlie API operations via dynamically loaded function references.

Official
Advanced
GhostPWNGhostPWN
4

Threat Hunting & IOC Analysis

Extract and normalize indicators of compromise from threat reports.

Official
Advanced