Pivot on IOC Skill
Explore relationships connected to an IOC within Google Threat Intelligence (GTI) to discover related entities for investigation expansion.
Inputs
IOC_VALUE - The indicator value to pivot fromIOC_TYPE - The type: "IP Address", "Domain", "File Hash", "URL", or "Collection"RELATIONSHIP_NAMES - List of relationships to query (see table below)
Available Relationships by IOC Type
| IOC Type |
Common Relationships |
| IP Address |
communicating_files, downloaded_files, referrer_files, resolutions |
| Domain |
resolutions, communicating_files, downloaded_files, subdomains, siblings |
| File Hash |
contacted_domains, contacted_ips, contacted_urls, dropped_files, embedded_domains |
| URL |
communicating_files, downloaded_files, last_serving_ip_address |
| Collection |
malware_families, attack_techniques, threat_actors, indicators |
Workflow
Step 1: Select GTI Tool
Based on IOC_TYPE:
| IOC Type |
Tool |
| IP Address |
gti-mcp.get_entities_related_to_an_ip_address |
| Domain |
gti-mcp.get_entities_related_to_a_domain |
| File Hash |
gti-mcp.get_entities_related_to_a_file |
| URL |
gti-mcp.get_entities_related_to_an_url |
| Collection |
gti-mcp.get_entities_related_to_a_collection |
Step 2: Query Each Relationship
For each relationship in RELATIONSHIP_NAMES:
[selected_tool](
identifier=IOC_VALUE,
relationship_name=relationship
)
Store results keyed by relationship name.
Required Outputs
After completing this skill, you MUST report these outputs:
| Output |
Description |
RELATED_ENTITIES |
Dictionary of entities found per relationship |
EXPANDED_IOCS |
Flattened list of all discovered IOCs (IPs, domains, hashes) |
THREAT_CONTEXT |
Threat actor/campaign context if found during pivoting |
PIVOT_STATUS |
Success/failure status of the pivoting |
Example Usage
File Hash Investigation:
IOC_VALUE: "abcdef123456..."
IOC_TYPE: "File Hash"
RELATIONSHIP_NAMES: ["contacted_domains", "contacted_ips", "dropped_files"]
Domain Investigation:
IOC_VALUE: "suspicious-domain.com"
IOC_TYPE: "Domain"
RELATIONSHIP_NAMES: ["resolutions", "communicating_files", "subdomains"]
1---2name: pivot-on-ioc3description: Explore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.4---5
6# Pivot on IOC Skill
7
8Explore relationships connected to an IOC within Google Threat Intelligence (GTI) to discover related entities for investigation expansion.
9
10## Inputs
11
12- `IOC_VALUE` - The indicator value to pivot from
13- `IOC_TYPE` - The type: "IP Address", "Domain", "File Hash", "URL", or "Collection"
14- `RELATIONSHIP_NAMES` - List of relationships to query (see table below)
15
16## Available Relationships by IOC Type
17
18| IOC Type | Common Relationships |
19|----------|---------------------|
20| IP Address | `communicating_files`, `downloaded_files`, `referrer_files`, `resolutions` |
21| Domain | `resolutions`, `communicating_files`, `downloaded_files`, `subdomains`, `siblings` |
22| File Hash | `contacted_domains`, `contacted_ips`, `contacted_urls`, `dropped_files`, `embedded_domains` |
23| URL | `communicating_files`, `downloaded_files`, `last_serving_ip_address` |
24| Collection | `malware_families`, `attack_techniques`, `threat_actors`, `indicators` |
25
26## Workflow
27
28### Step 1: Select GTI Tool
29
30Based on IOC_TYPE:
31
32| IOC Type | Tool |
33|----------|------|
34| IP Address | `gti-mcp.get_entities_related_to_an_ip_address` |
35| Domain | `gti-mcp.get_entities_related_to_a_domain` |
36| File Hash | `gti-mcp.get_entities_related_to_a_file` |
37| URL | `gti-mcp.get_entities_related_to_an_url` |
38| Collection | `gti-mcp.get_entities_related_to_a_collection` |
39
40### Step 2: Query Each Relationship
41
42For each relationship in `RELATIONSHIP_NAMES`:
43
44```
45[selected_tool](
46 identifier=IOC_VALUE,
47 relationship_name=relationship
48)
49```
50
51Store results keyed by relationship name.
52
53## Required Outputs
54
55**After completing this skill, you MUST report these outputs:**
56
57| Output | Description |
58|--------|-------------|
59| `RELATED_ENTITIES` | Dictionary of entities found per relationship |
60| `EXPANDED_IOCS` | Flattened list of all discovered IOCs (IPs, domains, hashes) |
61| `THREAT_CONTEXT` | Threat actor/campaign context if found during pivoting |
62| `PIVOT_STATUS` | Success/failure status of the pivoting |
63
64## Example Usage
65
66**File Hash Investigation:**
67```
68IOC_VALUE: "abcdef123456..."
69IOC_TYPE: "File Hash"
70RELATIONSHIP_NAMES: ["contacted_domains", "contacted_ips", "dropped_files"]
71```
72
73**Domain Investigation:**
74```
75IOC_VALUE: "suspicious-domain.com"
76IOC_TYPE: "Domain"
77RELATIONSHIP_NAMES: ["resolutions", "communicating_files", "subdomains"]
78```
majiayu000