‹ 首页

enrich-ioc

@dandye · 收录于 5 天前 · 上游提交 3 个月前

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

场景威胁分析安全运营事件响应

适合你，如果需要快速获取IOC的威胁情报和上下文。

/ 下载安装
https://github.com/dandye/ai-runbooks/tree/main/skills/enrich-ioc ↗
/ 通过 npx 安装 校验哈希
npx oh-my-skill add dandye/ai-runbooks/enrich-ioc
/ 通过 bash 安装
curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- dandye/ai-runbooks/enrich-ioc
/ 已经装过?验证本机副本,不用重装
npx oh-my-skill verify dandye/ai-runbooks/enrich-ioc
安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。
119GitHub stars
~547上下文体积 · 单文件
索引托管

怎么用

商店整理自技能原文 · 版本 086cbf6 · 表述以原文为准
它做什么

装上后，当你提供一个IOC（IP、域名、文件哈希或URL）时，Claude会利用Google Threat Intelligence (GTI)和Chronicle SIEM查询该指标的声誉、上下文和匹配状态，并输出威胁评分和恶意置信度。

什么时候触发

当你请求查询某个IOC的威胁情报或需要分析其声誉和上下文时触发。例如：查询一个IP地址、域名、文件哈希或URL。

装好后可以这样说
会返回域名的GTI分类、关联的恶意软件家族等。
技能原文 SKILL.md作者撰写 · Apache-2.0 · 086cbf6

Enrich IOC Skill

Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.

Inputs
  • IOC_VALUE - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")
  • IOC_TYPE - The type: "IP Address", "Domain", "File Hash", or "URL"
Workflow
Step 1: GTI Enrichment

Based on IOC_TYPE, call the appropriate GTI tool:

| IOC Type | Tool | Example | |----------|------|---------| | IP Address | gti-mcp.get_ip_address_report | get_ip_address_report(ip_address="198.51.100.10") | | Domain | gti-mcp.get_domain_report | get_domain_report(domain="evil-domain.com") | | File Hash | gti-mcp.get_file_report | get_file_report(hash="abcdef123...") | | URL | gti-mcp.get_url_report | get_url_report(url="http://bad.url/path") |

Store key findings in GTI_FINDINGS:

  • Reputation score
  • Classification (malicious, suspicious, clean)
  • Key relationships (contacted domains, IPs, etc.)
  • Associated malware families or campaigns

Error Handling: If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.

Step 2: SIEM Entity Lookup
secops-mcp.lookup_entity(entity_value=IOC_VALUE)

Store in SIEM_ENTITY_SUMMARY:

  • First/last seen timestamps
  • Related alerts
  • Associated assets/users
Step 3: SIEM IOC Match Check
secops-mcp.get_ioc_matches()

Check if IOC_VALUE appears in results. Store Yes/No in SIEM_IOC_MATCH_STATUS.

Required Outputs

After completing this skill, you MUST report these outputs:

| Output | Description | |--------|-------------| | GTI_FINDINGS | Summary of GTI report (reputation, classification, relationships) | | SIEM_SUMMARY | SIEM entity context (first/last seen, related alerts) | | IOC_MATCH_STATUS | Yes/No - whether IOC appears in recent threat feed matches | | THREAT_SCORE | Numerical threat score (0-100) based on GTI reputation | | MALICIOUS_CONFIDENCE | Confidence level: high, medium, low, or none |

Quick Reference

GTI Tools:

  • get_ip_address_report(ip_address)
  • get_domain_report(domain)
  • get_file_report(hash)
  • get_url_report(url)

SIEM Tools:

  • lookup_entity(entity_value)
  • get_ioc_matches()
按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

评论

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。
…