pivot-on-ioc

name	pivot-on-ioc
description	Explore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.
required_roles	{"gti":"GTI Enterprise+"}
personas	["tier2-analyst","tier3-analyst","threat-hunter"]

Pivot on IOC Skill

Explore relationships connected to an IOC within Google Threat Intelligence (GTI) to discover related entities for investigation expansion.

Inputs

• IOC_VALUE - The indicator value to pivot from
• IOC_TYPE - The type: "IP Address", "Domain", "File Hash", "URL", or "Collection"
• RELATIONSHIP_NAMES - List of relationships to query (see table below)

Available Relationships by IOC Type

IOC Type	Common Relationships
IP Address	communicating_files, downloaded_files, referrer_files, resolutions
Domain	resolutions, communicating_files, downloaded_files, subdomains, siblings
File Hash	contacted_domains, contacted_ips, contacted_urls, dropped_files, embedded_domains
URL	communicating_files, downloaded_files, last_serving_ip_address
Collection	malware_families, attack_techniques, threat_actors, indicators

Workflow

Step 1: Select GTI Tool

Based on IOC_TYPE:

IOC Type	Tool
IP Address	gti-mcp.get_entities_related_to_an_ip_address
Domain	gti-mcp.get_entities_related_to_a_domain
File Hash	gti-mcp.get_entities_related_to_a_file
URL	gti-mcp.get_entities_related_to_an_url
Collection	gti-mcp.get_entities_related_to_a_collection

Step 2: Query Each Relationship

For each relationship in RELATIONSHIP_NAMES:

[selected_tool](
    identifier=IOC_VALUE,
    relationship_name=relationship
)

Store results keyed by relationship name.

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
RELATED_ENTITIES	Dictionary of entities found per relationship
EXPANDED_IOCS	Flattened list of all discovered IOCs (IPs, domains, hashes)
THREAT_CONTEXT	Threat actor/campaign context if found during pivoting
PIVOT_STATUS	Success/failure status of the pivoting

Example Usage

File Hash Investigation:

IOC_VALUE: "abcdef123456..."
IOC_TYPE: "File Hash"
RELATIONSHIP_NAMES: ["contacted_domains", "contacted_ips", "dropped_files"]

Domain Investigation:

IOC_VALUE: "suspicious-domain.com"
IOC_TYPE: "Domain"
RELATIONSHIP_NAMES: ["resolutions", "communicating_files", "subdomains"]