/enrich-ioc

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

BOOST

dandye@dandye

GitHub

From plugin

ai-runbooks

12830 skills

Install

$ npx -y skills add dandye/ai-runbooks --skill enrich-ioc --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/enrich-ioc

Context preview

The summary Claude sees to decide when to auto-load this skill.

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

SKILL.md

enrich-ioc.SKILL.md

type: Skill
name: enrich-ioc
description: "Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status."
required_roles:
  chronicle: roles/chronicle.viewer
  gti: GTI Standard
personas: [tier1-analyst, tier2-analyst, tier3-analyst, threat-hunter, incident-responder]
generated:
  by: human:mlutx
  at: 2026-01-13T16:30:44-06:00

Enrich IOC Skill

Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.

Inputs

`IOC_VALUE` - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")
`IOC_TYPE` - The type: "IP Address", "Domain", "File Hash", or "URL"

Workflow

Step 1: GTI Enrichment

Based on IOC_TYPE, call the appropriate GTI tool:

| IOC Type | Tool | Example | |----------|------|---------| | IP Address | `gti-mcp.get_ip_address_report` | `get_ip_address_report(ip_address="198.51.100.10")` | | Domain | `gti-mcp.get_domain_report` | `get_domain_report(domain="evil-domain.com")` | | File Hash | `gti-mcp.get_file_report` | `get_file_report(hash="abcdef123...")` | | URL | `gti-mcp.get_url_report` | `get_url_report(url="http://bad.url/path")` |

Store key findings in `GTI_FINDINGS`:

Reputation score
Classification (malicious, suspicious, clean)
Key relationships (contacted domains, IPs, etc.)
Associated malware families or campaigns

**Error Handling:** If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.

Step 2: SIEM Entity Lookup

secops-mcp.lookup_entity(entity_value=IOC_VALUE)

Store in `SIEM_ENTITY_SUMMARY`:

First/last seen timestamps
Related alerts
Associated assets/users

Step 3: SIEM IOC Match Check

secops-mcp.get_ioc_matches()

Check if IOC_VALUE appears in results. Store Yes/No in `SIEM_IOC_MATCH_STATUS`.

Required Outputs

**After completing this skill, you MUST report these outputs:**

| Output | Description | |--------|-------------| | `GTI_FINDINGS` | Summary of GTI report (reputation, classification, relationships) | | `SIEM_SUMMARY` | SIEM entity context (first/last seen, related alerts) | | `IOC_MATCH_STATUS` | Yes/No - whether IOC appears in recent threat feed matches | | `THREAT_SCORE` | Numerical threat score (0-100) based on GTI reputation | | `MALICIOUS_CONFIDENCE` | Confidence level: `high`, `medium`, `low`, or `none` |