How do I install the Enrich Ioc skill?

Run npx skillmds@latest add dandye/enrich-ioc in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Enrich Ioc safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Enrich Ioc?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Enrich Ioc free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Enrich Ioc?

dandye (@dandye) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Enrich Ioc by dandye — Agent Skill

Name: Enrich Ioc
Rating: 4.2 (5 reviews)
Author: dandye

Enrich Ioc

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

dandye Updated Sep 10, 2026

File contents

Enrich IOC Skill

Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.

Inputs

IOC_VALUE - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")
IOC_TYPE - The type: "IP Address", "Domain", "File Hash", or "URL"

Workflow

Step 1: GTI Enrichment

Based on IOC_TYPE, call the appropriate GTI tool:

IOC Type	Tool	Example
IP Address	`gti-mcp.get_ip_address_report`	`get_ip_address_report(ip_address="198.51.100.10")`
Domain	`gti-mcp.get_domain_report`	`get_domain_report(domain="evil-domain.com")`
File Hash	`gti-mcp.get_file_report`	`get_file_report(hash="abcdef123...")`
URL	`gti-mcp.get_url_report`	`get_url_report(url="http://bad.url/path")`

Store key findings in GTI_FINDINGS:

Reputation score
Classification (malicious, suspicious, clean)
Key relationships (contacted domains, IPs, etc.)
Associated malware families or campaigns

Error Handling: If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.

Step 2: SIEM Entity Lookup

secops-mcp.lookup_entity(entity_value=IOC_VALUE)

Store in SIEM_ENTITY_SUMMARY:

First/last seen timestamps
Related alerts
Associated assets/users

Step 3: SIEM IOC Match Check

secops-mcp.get_ioc_matches()

Check if IOC_VALUE appears in results. Store Yes/No in SIEM_IOC_MATCH_STATUS.

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
`GTI_FINDINGS`	Summary of GTI report (reputation, classification, relationships)
`SIEM_SUMMARY`	SIEM entity context (first/last seen, related alerts)
`IOC_MATCH_STATUS`	Yes/No - whether IOC appears in recent threat feed matches
`THREAT_SCORE`	Numerical threat score (0-100) based on GTI reputation
`MALICIOUS_CONFIDENCE`	Confidence level: `high`, `medium`, `low`, or `none`

Quick Reference

GTI Tools:

get_ip_address_report(ip_address)
get_domain_report(domain)
get_file_report(hash)
get_url_report(url)

SIEM Tools:

lookup_entity(entity_value)
get_ioc_matches()

---name: enrich-iocdescription: Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.---# Enrich IOC SkillPerform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.## Inputs- `IOC_VALUE` - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")- `IOC_TYPE` - The type: "IP Address", "Domain", "File Hash", or "URL"## Workflow### Step 1: GTI EnrichmentBased on IOC_TYPE, call the appropriate GTI tool:| IOC Type | Tool | Example ||----------|------|---------|| IP Address | `gti-mcp.get_ip_address_report` | `get_ip_address_report(ip_address="198.51.100.10")` || Domain | `gti-mcp.get_domain_report` | `get_domain_report(domain="evil-domain.com")` || File Hash | `gti-mcp.get_file_report` | `get_file_report(hash="abcdef123...")` || URL | `gti-mcp.get_url_report` | `get_url_report(url="http://bad.url/path")` |Store key findings in `GTI_FINDINGS`:- Reputation score- Classification (malicious, suspicious, clean)- Key relationships (contacted domains, IPs, etc.)- Associated malware families or campaigns**Error Handling:** If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.### Step 2: SIEM Entity Lookup```secops-mcp.lookup_entity(entity_value=IOC_VALUE)```Store in `SIEM_ENTITY_SUMMARY`:- First/last seen timestamps- Related alerts- Associated assets/users### Step 3: SIEM IOC Match Check```secops-mcp.get_ioc_matches()```Check if IOC_VALUE appears in results. Store Yes/No in `SIEM_IOC_MATCH_STATUS`.## Required Outputs**After completing this skill, you MUST report these outputs:**| Output | Description ||--------|-------------|| `GTI_FINDINGS` | Summary of GTI report (reputation, classification, relationships) || `SIEM_SUMMARY` | SIEM entity context (first/last seen, related alerts) || `IOC_MATCH_STATUS` | Yes/No - whether IOC appears in recent threat feed matches || `THREAT_SCORE` | Numerical threat score (0-100) based on GTI reputation || `MALICIOUS_CONFIDENCE` | Confidence level: `high`, `medium`, `low`, or `none` |## Quick Reference**GTI Tools:**- `get_ip_address_report(ip_address)`- `get_domain_report(domain)`- `get_file_report(hash)`- `get_url_report(url)`**SIEM Tools:**- `lookup_entity(entity_value)`- `get_ioc_matches()`

Frequently asked questions