Enrich IOC Skill

enrich-ioc

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

dandye/ai-runbooks·0installs127starsProductivity & Planning

SKILL.md

Full skill instructions

Enrich IOC Skill

Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.

Inputs

IOC_VALUE - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")
IOC_TYPE - The type: "IP Address", "Domain", "File Hash", or "URL"

Workflow

Step 1: GTI Enrichment

Based on IOC_TYPE, call the appropriate GTI tool:

IOC Type	Tool	Example
IP Address	`gti-mcp.get_ip_address_report`	`get_ip_address_report(ip_address="198.51.100.10")`
Domain	`gti-mcp.get_domain_report`	`get_domain_report(domain="evil-domain.com")`
File Hash	`gti-mcp.get_file_report`	`get_file_report(hash="abcdef123...")`
URL	`gti-mcp.get_url_report`	`get_url_report(url="http://bad.url/path")`

Store key findings in GTI_FINDINGS:

Reputation score
Classification (malicious, suspicious, clean)
Key relationships (contacted domains, IPs, etc.)
Associated malware families or campaigns

Error Handling: If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.

Step 2: SIEM Entity Lookup

secops-mcp.lookup_entity(entity_value=IOC_VALUE)

Store in SIEM_ENTITY_SUMMARY:

First/last seen timestamps
Related alerts
Associated assets/users

Step 3: SIEM IOC Match Check

secops-mcp.get_ioc_matches()

Check if IOC_VALUE appears in results. Store Yes/No in SIEM_IOC_MATCH_STATUS.

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
`GTI_FINDINGS`	Summary of GTI report (reputation, classification, relationships)
`SIEM_SUMMARY`	SIEM entity context (first/last seen, related alerts)
`IOC_MATCH_STATUS`	Yes/No - whether IOC appears in recent threat feed matches
`THREAT_SCORE`	Numerical threat score (0-100) based on GTI reputation
`MALICIOUS_CONFIDENCE`	Confidence level: `high`, `medium`, `low`, or `none`

Quick Reference

GTI Tools:

get_ip_address_report(ip_address)
get_domain_report(domain)
get_file_report(hash)
get_url_report(url)

SIEM Tools:

lookup_entity(entity_value)
get_ioc_matches()

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/dandye/ai-runbooks --skill enrich-ioc

View on GitHub

skills/enrich-ioc/SKILL.md

More Productivity & Planning skills

View all

Productivity & Planning

brainstorming

Structured design dialogue that validates ideas before implementation begins.

295.4K 385.7K

View

Productivity & Planning

ui-ux-pro-max

Comprehensive design intelligence for web and mobile UI/UX across 10 technology stacks.

133.1K 383.9K

View

Productivity & Planning

writing-plans

Comprehensive implementation plans for multi-step tasks, breaking down specs into bite-sized, testable steps.

295.4K 268K

View

Productivity & Planning

using-superpowers

Introduction to the obra skills system with mandatory skill invocation rules and best practices.

295.4K 259.8K

View

Productivity & Planning

executing-plans

Execute a written implementation plan with critical review and task checkpoints.

295.4K 229.1K

View

Productivity & Planning

dispatching-parallel-agents

Delegate independent tasks to specialized agents working concurrently with isolated context.

295.4K 206.3K

View

Productivity & Planning

using-git-worktrees

Isolated git worktrees with smart directory selection and safety verification.

295.4K 205.2K

View

Productivity & Planning

webapp-testing

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

179.7K 170.6K

View