pivot-on-ioc

@dandye · 收录于 5 天前 · 上游提交 3 个月前

Explore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.

场景威胁溯源安全调查

适合你，如果正在分析IOC并需要扩展关联信息

/ 下载安装

https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc ↗

/ 通过 npx 安装 校验哈希

npx oh-my-skill add dandye/ai-runbooks/pivot-on-ioc

/ 通过 bash 安装

curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- dandye/ai-runbooks/pivot-on-ioc

/ 已经装过?验证本机副本,不用重装

npx oh-my-skill verify dandye/ai-runbooks/pivot-on-ioc

安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。

119GitHub stars

~462上下文体积 · 单文件

索引托管

怎么用

商店整理自技能原文 · 版本 086cbf6 · 表述以原文为准

它做什么

Claude会利用Google Threat Intelligence，根据你提供的IOC（如IP、域名、文件哈希）查询与之相关的实体（如关联的域名、IP、文件、威胁行为者），并将发现的新IOC和威胁上下文汇总输出。

什么时候触发

当你提供一个IOC（IP、域名、文件哈希、URL或Collection）并指定要查询的关系类型时触发。例如，在调查恶意文件时，想找它连接的域名。

装好后可以这样说

会返回与该IP通信的文件列表

会返回子域名和IP解析历史

会返回文件通信的域名列表

技能原文 SKILL.md作者撰写 · Apache-2.0 · 086cbf6

Pivot on IOC Skill

Explore relationships connected to an IOC within Google Threat Intelligence (GTI) to discover related entities for investigation expansion.

Inputs

IOC_VALUE - The indicator value to pivot from
IOC_TYPE - The type: "IP Address", "Domain", "File Hash", "URL", or "Collection"
RELATIONSHIP_NAMES - List of relationships to query (see table below)

Available Relationships by IOC Type

| IOC Type | Common Relationships | |----------|---------------------| | IP Address | communicating_files, downloaded_files, referrer_files, resolutions | | Domain | resolutions, communicating_files, downloaded_files, subdomains, siblings | | File Hash | contacted_domains, contacted_ips, contacted_urls, dropped_files, embedded_domains | | URL | communicating_files, downloaded_files, last_serving_ip_address | | Collection | malware_families, attack_techniques, threat_actors, indicators |

Workflow

Step 1: Select GTI Tool

Based on IOC_TYPE:

| IOC Type | Tool | |----------|------| | IP Address | gti-mcp.get_entities_related_to_an_ip_address | | Domain | gti-mcp.get_entities_related_to_a_domain | | File Hash | gti-mcp.get_entities_related_to_a_file | | URL | gti-mcp.get_entities_related_to_an_url | | Collection | gti-mcp.get_entities_related_to_a_collection |

Step 2: Query Each Relationship

For each relationship in RELATIONSHIP_NAMES:

[selected_tool](
    identifier=IOC_VALUE,
    relationship_name=relationship
)

Store results keyed by relationship name.

Required Outputs

After completing this skill, you MUST report these outputs:

| Output | Description | |--------|-------------| | RELATED_ENTITIES | Dictionary of entities found per relationship | | EXPANDED_IOCS | Flattened list of all discovered IOCs (IPs, domains, hashes) | | THREAT_CONTEXT | Threat actor/campaign context if found during pivoting | | PIVOT_STATUS | Success/failure status of the pivoting |

Example Usage

File Hash Investigation:

IOC_VALUE: "abcdef123456..."
IOC_TYPE: "File Hash"
RELATIONSHIP_NAMES: ["contacted_domains", "contacted_ips", "dropped_files"]

Domain Investigation:

IOC_VALUE: "suspicious-domain.com"
IOC_TYPE: "Domain"
RELATIONSHIP_NAMES: ["resolutions", "communicating_files", "subdomains"]

按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。

…