dandye/adk_runbooks

detection-engineering-coverage-evaluation

Use when evaluating threat detection opportunities (TDOs), generating synthetic UDM events, evaluating Chronicle rule coverage, and drafting YARA-L 2.0 rules.

apt-threat-hunt

Use when hunting for advanced persistent threat (APT) actor activity, tools, and infrastructure.

lateral-movement-hunt-psexec-wmi

Use when hunting for lateral movement via PsExec, WMI, remote scheduled tasks, or WinRM.

proactive-hunt-gti-campaign

Use when initiating threat hunting operations driven by GTI threat campaign intelligence.

basic-ioc-enrichment

Use when conducting initial reputation and threat intelligence lookups on suspicious observables.

deep-dive-ioc-analysis

Use when performing exhaustive forensic and intelligence analysis on complex indicators of compromise.

investigate-case-external-tools

Use when enriching and verifying case artifacts with external threat intelligence platforms.

ioc-containment

Use when executing network, host, or credential containment actions for validated malicious IOCs.

prioritize-and-investigate-case

Use when scoring case urgency, prioritizing the queue, and running core investigations.

compromised-user-account-response

Use when executing containment, eradication, and recovery for confirmed compromised user credentials.

malware-incident-response

Use when coordinating response and remediation for advanced malware infections.

phishing-response

Use when responding to reported phishing emails, malicious links, or credential harvesting campaigns.

ransomware-response

Use when responding to active ransomware deployment, host encryption, or extortion threats.

create-investigation-report

Use when compiling comprehensive incident investigation findings and executive summaries.

cloud-vulnerability-triage

Use when triaging cloud security posture vulnerabilities and contextualizing finding risk.

malware-triage

Use when analyzing malware detection alerts, isolating infected endpoints, and scoping file executions.

suspicious-login-triage

Use when triaging anomalous or suspicious user authentication events, impossible travel, and credential anomalies.

triage-alerts

Use when evaluating and categorizing incoming security alerts to determine severity and initial response actions.

domain-get-gti-report

Use when fetching GTI threat reputation and WHOIS intelligence for a specific domain name.

domain-get-secops-threat-intel

Use when retrieving Chronicle SecOps threat intelligence and IOC matches for a domain.

domain-lookup-entity-chronicle

Use when looking up domain entity graph associations and historical context in Chronicle.

domain-search-dns-chronicle

Use when searching UDM DNS query and resolution logs for a domain in Chronicle.

domain-search-network-traffic-chronicle

Use when querying Chronicle for network connections, HTTP requests, or TLS traffic to a domain.

hash-get-gti-report

Use when querying GTI and VirusTotal reputation and sandbox verdicts for a file hash.

hash-get-secops-threat-intel

Use when retrieving SecOps threat intelligence matches for a SHA256, SHA1, or MD5 hash.

hash-lookup-entity-chronicle

Use when inspecting Chronicle entity records for known malicious or suspicious file hashes.

hash-search-process-events-chronicle

Use when searching Chronicle for process execution events matching a file hash.

ip-get-gti-report

Use when fetching GTI reputation, ASN, and geolocation details for an IP address.

ip-get-secops-threat-intel

Use when querying Chronicle SecOps threat intelligence feeds for an IP address.

ip-lookup-entity-chronicle

Use when examining Chronicle entity graph and asset context for an internal or external IP.

ip-search-network-traffic-chronicle

Use when querying UDM network connection events in Chronicle involving a target IP address.

url-get-gti-report

Use when retrieving GTI threat classification and URL category intelligence.

url-get-secops-threat-intel

Use when querying SecOps threat intelligence indicators for a specific URL.

url-search-chronicle

Use when searching Chronicle proxy and web access logs for HTTP/HTTPS requests to a URL.

user-lookup-entity-chronicle

Use when querying Chronicle user entity details, department, manager, and role context.

user-search-login-activity-chronicle

Use when searching Chronicle authentication events for a user's recent login activity.

user-search-process-activity-chronicle

Use when searching Chronicle endpoint logs for process launches initiated by a specific user.

check-duplicate-cases

Use when checking SOAR cases for overlapping entities to detect duplicate incidents.

close-soar-artifact

Use when setting SOAR alert or case closure status and root cause reason codes.

confirm-action

Use when requesting human operator confirmation before disruptive remediation actions.