Enrich IOC Skill
Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.
Inputs
IOC_VALUE - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")IOC_TYPE - The type: "IP Address", "Domain", "File Hash", or "URL"
Workflow
Step 1: GTI Enrichment
Based on IOC_TYPE, call the appropriate GTI tool:
| IOC Type |
Tool |
Example |
| IP Address |
gti-mcp.get_ip_address_report |
get_ip_address_report(ip_address="198.51.100.10") |
| Domain |
gti-mcp.get_domain_report |
get_domain_report(domain="evil-domain.com") |
| File Hash |
gti-mcp.get_file_report |
get_file_report(hash="abcdef123...") |
| URL |
gti-mcp.get_url_report |
get_url_report(url="http://bad.url/path") |
Store key findings in GTI_FINDINGS:
- Reputation score
- Classification (malicious, suspicious, clean)
- Key relationships (contacted domains, IPs, etc.)
- Associated malware families or campaigns
Error Handling: If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.
Step 2: SIEM Entity Lookup
secops-mcp.lookup_entity(entity_value=IOC_VALUE)
Store in SIEM_ENTITY_SUMMARY:
- First/last seen timestamps
- Related alerts
- Associated assets/users
Step 3: SIEM IOC Match Check
secops-mcp.get_ioc_matches()
Check if IOC_VALUE appears in results. Store Yes/No in SIEM_IOC_MATCH_STATUS.
Required Outputs
After completing this skill, you MUST report these outputs:
| Output |
Description |
GTI_FINDINGS |
Summary of GTI report (reputation, classification, relationships) |
SIEM_SUMMARY |
SIEM entity context (first/last seen, related alerts) |
IOC_MATCH_STATUS |
Yes/No - whether IOC appears in recent threat feed matches |
THREAT_SCORE |
Numerical threat score (0-100) based on GTI reputation |
MALICIOUS_CONFIDENCE |
Confidence level: high, medium, low, or none |
Quick Reference
GTI Tools:
get_ip_address_report(ip_address)get_domain_report(domain)get_file_report(hash)get_url_report(url)
SIEM Tools:
lookup_entity(entity_value)get_ioc_matches()
1---2type: Skill3name: enrich-ioc4description: "Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status."5required_roles:6 chronicle: roles/chronicle.viewer7 gti: GTI Standard8personas: [tier1-analyst, tier2-analyst, tier3-analyst, threat-hunter, incident-responder]9generated:10 by: human:mlutx11 at: 2026-01-13T16:30:44-06:0012---1314# Enrich IOC Skill1516Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.1718## Inputs1920- `IOC_VALUE` - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path")21- `IOC_TYPE` - The type: "IP Address", "Domain", "File Hash", or "URL"2223## Workflow2425### Step 1: GTI Enrichment2627Based on IOC_TYPE, call the appropriate GTI tool:2829| IOC Type | Tool | Example |30|----------|------|---------|31| IP Address | `gti-mcp.get_ip_address_report` | `get_ip_address_report(ip_address="198.51.100.10")` |32| Domain | `gti-mcp.get_domain_report` | `get_domain_report(domain="evil-domain.com")` |33| File Hash | `gti-mcp.get_file_report` | `get_file_report(hash="abcdef123...")` |34| URL | `gti-mcp.get_url_report` | `get_url_report(url="http://bad.url/path")` |3536Store key findings in `GTI_FINDINGS`:37- Reputation score38- Classification (malicious, suspicious, clean)39- Key relationships (contacted domains, IPs, etc.)40- Associated malware families or campaigns4142**Error Handling:** If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.4344### Step 2: SIEM Entity Lookup4546```47secops-mcp.lookup_entity(entity_value=IOC_VALUE)48```4950Store in `SIEM_ENTITY_SUMMARY`:51- First/last seen timestamps52- Related alerts53- Associated assets/users5455### Step 3: SIEM IOC Match Check5657```58secops-mcp.get_ioc_matches()59```6061Check if IOC_VALUE appears in results. Store Yes/No in `SIEM_IOC_MATCH_STATUS`.6263## Required Outputs6465**After completing this skill, you MUST report these outputs:**6667| Output | Description |68|--------|-------------|69| `GTI_FINDINGS` | Summary of GTI report (reputation, classification, relationships) |70| `SIEM_SUMMARY` | SIEM entity context (first/last seen, related alerts) |71| `IOC_MATCH_STATUS` | Yes/No - whether IOC appears in recent threat feed matches |72| `THREAT_SCORE` | Numerical threat score (0-100) based on GTI reputation |73| `MALICIOUS_CONFIDENCE` | Confidence level: `high`, `medium`, `low`, or `none` |7475## Quick Reference7677**GTI Tools:**78- `get_ip_address_report(ip_address)`79- `get_domain_report(domain)`80- `get_file_report(hash)`81- `get_url_report(url)`8283**SIEM Tools:**84- `lookup_entity(entity_value)`85- `get_ioc_matches()`
dandye