Pivot on IOC Skill

pivot-on-ioc

Explore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.

dandye/ai-runbooks·0installs127starsProductivity & Planning

SKILL.md

Full skill instructions

Pivot on IOC Skill

Explore relationships connected to an IOC within Google Threat Intelligence (GTI) to discover related entities for investigation expansion.

Inputs

IOC_VALUE - The indicator value to pivot from
IOC_TYPE - The type: "IP Address", "Domain", "File Hash", "URL", or "Collection"
RELATIONSHIP_NAMES - List of relationships to query (see table below)

Available Relationships by IOC Type

IOC Type	Common Relationships
IP Address	`communicating_files`, `downloaded_files`, `referrer_files`, `resolutions`
Domain	`resolutions`, `communicating_files`, `downloaded_files`, `subdomains`, `siblings`
File Hash	`contacted_domains`, `contacted_ips`, `contacted_urls`, `dropped_files`, `embedded_domains`
URL	`communicating_files`, `downloaded_files`, `last_serving_ip_address`
Collection	`malware_families`, `attack_techniques`, `threat_actors`, `indicators`

Workflow

Step 1: Select GTI Tool

Based on IOC_TYPE:

IOC Type	Tool
IP Address	`gti-mcp.get_entities_related_to_an_ip_address`
Domain	`gti-mcp.get_entities_related_to_a_domain`
File Hash	`gti-mcp.get_entities_related_to_a_file`
URL	`gti-mcp.get_entities_related_to_an_url`
Collection	`gti-mcp.get_entities_related_to_a_collection`

Step 2: Query Each Relationship

For each relationship in RELATIONSHIP_NAMES:

[selected_tool](
    identifier=IOC_VALUE,
    relationship_name=relationship
)

Store results keyed by relationship name.

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
`RELATED_ENTITIES`	Dictionary of entities found per relationship
`EXPANDED_IOCS`	Flattened list of all discovered IOCs (IPs, domains, hashes)
`THREAT_CONTEXT`	Threat actor/campaign context if found during pivoting
`PIVOT_STATUS`	Success/failure status of the pivoting

Example Usage

File Hash Investigation:

IOC_VALUE: "abcdef123456..."
IOC_TYPE: "File Hash"
RELATIONSHIP_NAMES: ["contacted_domains", "contacted_ips", "dropped_files"]

Domain Investigation:

IOC_VALUE: "suspicious-domain.com"
IOC_TYPE: "Domain"
RELATIONSHIP_NAMES: ["resolutions", "communicating_files", "subdomains"]

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/dandye/ai-runbooks --skill pivot-on-ioc

View on GitHub

skills/pivot-on-ioc/SKILL.md

More Productivity & Planning skills

View all

Productivity & Planning

brainstorming

Structured design dialogue that validates ideas before implementation begins.

295.4K 385.7K

View

Productivity & Planning

ui-ux-pro-max

Comprehensive design intelligence for web and mobile UI/UX across 10 technology stacks.

133.1K 383.9K

View

Productivity & Planning

writing-plans

Comprehensive implementation plans for multi-step tasks, breaking down specs into bite-sized, testable steps.

295.4K 268K

View

Productivity & Planning

using-superpowers

Introduction to the obra skills system with mandatory skill invocation rules and best practices.

295.4K 259.8K

View

Productivity & Planning

executing-plans

Execute a written implementation plan with critical review and task checkpoints.

295.4K 229.1K

View

Productivity & Planning

dispatching-parallel-agents

Delegate independent tasks to specialized agents working concurrently with isolated context.

295.4K 206.3K

View

Productivity & Planning

using-git-worktrees

Isolated git worktrees with smart directory selection and safety verification.

295.4K 205.2K

View

Productivity & Planning

webapp-testing

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

179.7K 170.6K

View