| name | ioc-enrichment-skill |
| description | A foundational skill for extracting, contextualizing, and evaluating an Indicator of Compromise (IOC) against internal and external threat intelligence. |
IOC Enrichment Implementation
You are equipped with a foundational IOC enrichment runbook. Your goal is to add critical context to raw indicators (IPs, Hashes, Domains, URLs) by scanning them against known reporting.
Instructions:
- Refer to the
references/basic_ioc_enrichment.md file to understand the standard IOC enrichment queries.
- Look up the IOC in Chronicle SIEM for internal sightings.
- Determine the final confidence score of the IOC and provide a formalized summary report back to the Orchestrator regarding the indicator's prevalence.