| name | ioc-pivot |
| description | IOC pivots for a CVE — top IPs, ASNs, geo distribution, ATT&CK technique chain, Shadowserver scan counts (1d/7d/30d/90d averages), CrowdSec community sightings, merged in-the-wild timeline. Optional STIX 2.1 bundle export for Splunk / Sentinel / Cortex / Tines ingestion. Use when investigating an active CVE, building a blocklist, exporting to SOAR, or correlating with internal SIEM logs. |
| argument-hint | <vuln-id> |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["ioc","sightings","indicators of compromise","stix"] |
| chain | ["detection-rules","attack-mapping"] |
| outputBudget | medium |
| cooldown | per-session |
Vulnetix IOC Pivot Skill
Use when
- A CVE is actively exploited and you need a blocklist of attacker IPs/ASNs to feed your edge firewall.
- Exporting to STIX 2.1 for Splunk / Sentinel / Cortex / Tines ingestion.
- Building a geo-distribution view of attack origin for an executive brief.
- Correlating CrowdSec community sightings with internal SIEM detections.
- Mapping the ATT&CK technique chain associated with the exploit.
Don't use for
- Generating detection rules for the IDS — use
/vulnetix:detection-rules.
- Single-CVE enrichment without IOC focus — use
/vulnetix:vuln.
- Cross-CVE IOC search by country/ASN — use
vulnetix vdb iocs list directly (this skill is per-CVE).
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Builds a SOC-grade IOC view for a single CVE — combines vdb iocs (CrowdSec sightings + Shadowserver counts) and vdb sightings (merged timeline) into a single report. Exports STIX bundle when the user has a SOAR sink.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Capture derived.soar to decide STIX export; capture derived.detection_stack to suggest follow-up rule fetches.
Step 2: Fetch IOCs
vulnetix vdb iocs "$ARGUMENTS" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/iocs.jq"
Pass through optional flags: --country, --asn, --limit, --since. Capture: top IPs, ASNs, country distribution, ATT&CK techniques observed, Shadowserver scan counts.
Step 3: Fetch sightings timeline
