dandye/ai-runbooks/enrich-ioc

Enrich IOC Skill

Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.

Inputs

• IOC_VALUE - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")
• IOC_TYPE - The type: "IP Address", "Domain", "File Hash", or "URL"

Workflow

Step 1: GTI Enrichment

Based on IOC_TYPE, call the appropriate GTI tool:

Store key findings in GTI_FINDINGS:

• Reputation score
• Classification (malicious, suspicious, clean)
• Key relationships (contacted domains, IPs, etc.)
• Associated malware families or campaigns

Error Handling: If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.

Step 2: SIEM Entity Lookup

secops-mcp.lookup_entity(entity_value=IOC_VALUE)

Store in SIEM_ENTITY_SUMMARY:

• First/last seen timestamps
• Related alerts
• Associated assets/users

Step 3: SIEM IOC Match Check

secops-mcp.get_ioc_matches()

Check if IOC_VALUE appears in results. Store Yes/No in SIEM_IOC_MATCH_STATUS.

Required Outputs

After completing this skill, you MUST report these outputs:

Quick Reference

GTI Tools:

• get_ip_address_report(ip_address)
• get_domain_report(domain)
• get_file_report(hash)
• get_url_report(url)

SIEM Tools:

• lookup_entity(entity_value)
• get_ioc_matches()