‹ 首页

correlate-ioc

@dandye · 收录于 5 天前 · 上游提交 3 个月前

Check for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations. Takes IOC list and returns related alerts and cases.

场景威胁研判事件调查

适合你，如果需要在安全运营中快速关联IOC的历史告警和案件。

/ 下载安装
https://github.com/dandye/ai-runbooks/tree/main/skills/correlate-ioc ↗
/ 通过 npx 安装 校验哈希
npx oh-my-skill add dandye/ai-runbooks/correlate-ioc
/ 通过 bash 安装
curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- dandye/ai-runbooks/correlate-ioc
/ 已经装过?验证本机副本,不用重装
npx oh-my-skill verify dandye/ai-runbooks/correlate-ioc
安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。
119GitHub stars
~485上下文体积 · 单文件
索引托管

怎么用

商店整理自技能原文 · 版本 086cbf6 · 表述以原文为准
它做什么

装上后，Claude能检查指定的威胁指标（如IP、域名）是否在之前触发了安全警报或关联的案例，并返回关联的警报信息和案例摘要。

什么时候触发

当用户提供威胁指标列表（如IP、域名）给Claude时触发；也可以指定时间范围或案例过滤器。

装好后可以这样说
返回该IP的SIEM警报和案例摘要。
返回与该域名相关的案例。
返回时间范围内的警报详情。
技能原文 SKILL.md作者撰写 · Apache-2.0 · 086cbf6

Correlate IOC Skill

Check for existing SIEM alerts and cases related to specific Indicators of Compromise.

Inputs
  • IOC_LIST - Single IOC or list of IOCs (e.g., ["198.51.100.10", "evil-domain.com"])
  • (Optional) TIME_FRAME_HOURS - Lookback period for SIEM alerts (default: 168 = 7 days)
  • (Optional) SOAR_CASE_FILTER - Additional filter for SOAR cases (e.g., status="OPEN")
Workflow
Step 1: Correlate SIEM Alerts

Search for alerts containing any IOC in the list:

secops-mcp.get_security_alerts(
    query=IOC_based_query,
    hours_back=TIME_FRAME_HOURS
)

Store summary in RELATED_SIEM_ALERTS:

  • Alert count
  • Alert types/names
  • Severity distribution
  • Affected assets
Step 2: Correlate Cases

Search for cases containing any IOC:

secops-soar.list_cases(
    filter=IOC_based_filter + SOAR_CASE_FILTER
)

Store summary in RELATED_SOAR_CASES:

  • Case IDs and names
  • Case status
  • Case priority
Required Outputs

After completing this skill, you MUST report these outputs:

| Output | Description | |--------|-------------| | RELATED_SIEM_ALERTS | Summary of SIEM alerts related to the IOC(s) | | RELATED_CASES | Summary of cases related to the IOC(s) | | CORRELATION_STATUS | Success/failure status of the correlation | | MALICIOUS_CONFIDENCE | Derived confidence based on alert history: high, medium, low, or none |

Use Cases
  1. Before Investigation - Check if IOC is already under investigation
  2. During Enrichment - Understand internal activity for an IOC
  3. Threat Hunt - Find all alerts/cases related to campaign indicators
  4. Incident Response - Identify scope of compromise across cases
Correlation Summary Template
IOC Correlation Summary for [IOC_LIST]:

SIEM Alerts (last [TIME_FRAME_HOURS] hours):
- Total alerts: [count]
- Alert types: [list]
- Affected hosts: [list]

Related Cases:
- Open cases: [count] - [IDs]
- Closed cases: [count]
- Related investigations: [summary]
按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

评论

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。
…