basic-ioc-enrichment

name	basic-ioc-enrichment
description	Use when conducting initial reputation and threat intelligence lookups on suspicious observables.
category	investigation
version	1.0.0
type	Skill
title	Skill: Basic IOC Enrichment Runbook
generated	{"by":"process:google-labs-jules","at":"2025-12-21T03:04:42.000Z"}

Basic IOC Enrichment Runbook

Objective

Standardize the initial enrichment process for a single Indicator of Compromise (IOC) identified in an alert or case, suitable for Tier 1 SOC Analysts.

Scope

This runbook covers fundamental enrichment steps using readily available GTI and SIEM lookup tools, plus limited SIEM event searching. It aims to provide quick, actionable context to aid in the decision to close or escalate.

Inputs

• ${IOC_VALUE}: The specific IOC value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path").
• ${IOC_TYPE}: The type of IOC (e.g., "IP Address", "Domain", "File Hash", "URL").
• (Optional) ${ALERT_GROUP_IDENTIFIERS}: Relevant alert group identifiers if needed for context in SOAR actions.
• (Optional) ${CASE_ID}: Relevant case ID if documentation is desired.
• (Optional) ${SIEM_SEARCH_HOURS}: Lookback period for SIEM event search (default: 24).

Outputs

• ${GTI_FINDINGS}: Summary of key findings from the relevant GTI report.
• ${GTI_RELATIONSHIPS}: Summary of key related entities found via GTI pivoting.
• ${SIEM_ENTITY_SUMMARY}: Summary from the SIEM entity lookup.
• ${SIEM_IOC_MATCH_STATUS}: Boolean or indicator (Yes/No) if the IOC was found in recent SIEM IOC matches.
• ${SIEM_RECENT_EVENTS}: Summary of recent SIEM events involving the IOC.
• ${FOUND_CASES}: List of potentially related open SOAR cases.
• ${ASSESSMENT}: Analyst's initial risk assessment (e.g., Low/Medium/High/Informational).
• ${RECOMMENDATION}: Suggested next steps (e.g., Escalate, Monitor, Close FP, Trigger Containment).
• ${DOCUMENTATION_STATUS}: Status of documentation attempt in SOAR.
• ${REPORT_GENERATION_STATUS}: Status of optional report generation.

Tools

• gti-mcp: get_ip_address_report, get_domain_report, get_file_report, get_url_report, get_entities_related_to_a_file, get_entities_related_to_a_domain, get_entities_related_to_an_ip_address, get_entities_related_to_an_url
• secops-mcp: lookup_entity, get_ioc_matches, search_security_events
• secops-soar: list_cases, post_case_comment
• You may ask follow up question
• write_report
• Common Steps: {doc}common_steps/enrich_ioc </run_books/common_steps/enrich_ioc>, {doc}common_steps/pivot_on_ioc_gti </run_books/common_steps/pivot_on_ioc_gti>, {doc}common_steps/find_relevant_soar_case </run_books/common_steps/find_relevant_soar_case>, {doc}common_steps/document_in_soar </run_books/common_steps/document_in_soar>, {doc}common_steps/generate_report_file </run_books/common_steps/generate_report_file>

Workflow Steps & Diagram

1. Receive Input: Obtain ${IOC_VALUE}, ${IOC_TYPE}, and optional inputs like ${CASE_ID}, ${ALERT_GROUP_IDENTIFIERS}, ${SIEM_SEARCH_HOURS} (default 24).
2. Enrich IOC (GTI + SIEM Lookup): Execute skills/common/enrich-ioc/SKILL.md with ${IOC_VALUE} and ${IOC_TYPE}. Obtain ${GTI_FINDINGS}, ${SIEM_ENTITY_SUMMARY}, ${SIEM_IOC_MATCH_STATUS}.
3. Fetch Key GTI Relationships:
   • Determine relevant relationships based on ${IOC_TYPE} (e.g., for File Hash: ["contacted_domains", "contacted_ips"]; for Domain: ["resolutions"]). Let this be REL_LIST.
   • Execute skills/common/pivot-on-ioc-gti/SKILL.md with ${IOC_VALUE}, ${IOC_TYPE}, and RELATIONSHIP_NAMES=REL_LIST. Obtain ${GTI_RELATIONSHIPS}.
4. Search Recent SIEM Events:
   • Construct a basic query for secops-mcp_search_security_events targeting ${IOC_VALUE} (e.g., text="${IOC_VALUE}").
   • Execute the search with hours_back=${SIEM_SEARCH_HOURS}.
   • Store a summary of findings (e.g., count, key event types, involved hosts/users) in ${SIEM_RECENT_EVENTS}.
5. Search Relevant SOAR Cases:
   • Execute skills/common/find-relevant-soar-case/SKILL.md with SEARCH_TERMS=["${IOC_VALUE}"] and CASE_STATUS_FILTER="Opened".
   • Obtain ${RELEVANT_CASE_IDS} and ${RELEVANT_CASE_SUMMARIES}. Let ${FOUND_CASES} = ${RELEVANT_CASE_SUMMARIES} (or ${RELEVANT_CASE_IDS} if summaries aren't needed/available).
6. Synthesize Findings & Assess Risk:
   • Combine all findings: ${GTI_FINDINGS}, ${GTI_RELATIONSHIPS}, ${SIEM_ENTITY_SUMMARY}, ${SIEM_IOC_MATCH_STATUS}, , .

ADK Graph-Based Workflow Diagram

graph TD
    START(["START"]) --> extract_ioc_node["1. extract_ioc_node<br/><i>(Extract & Normalize IOC)</i>"]
    extract_ioc_node --> ioc_type_router{"2. ioc_type_router<br/><i>(Route by IOC_TYPE)</i>"}

    ioc_type_router -- "IP_BRANCH" --> enrich_ip_branch["3a. enrich_ip_branch<br/><i>(GTI & SIEM IP Lookup)</i>"]
    ioc_type_router -- "DOMAIN_BRANCH" --> enrich_domain_branch["3b. enrich_domain_branch<br/><i>(GTI Domain & Passive DNS)</i>"]
    ioc_type_router -- "HASH_BRANCH" --> enrich_hash_branch["3c. enrich_hash_branch<br/><i>(GTI File & Behavior Summary)</i>"]
    ioc_type_router -- "URL_BRANCH" --> enrich_url_branch["3d. enrich_url_branch<br/><i>(GTI URL Report & Domain Rep)</i>"]

    enrich_ip_branch --> siem_search_node["4. siem_search_node<br/><i>(SIEM Event Search & Case Lookup)</i>"]
    enrich_domain_branch --> siem_search_node
    enrich_hash_branch --> siem_search_node
    enrich_url_branch --> siem_search_node

    siem_search_node --> ioc_risk_router{"5. ioc_risk_router<br/><i>(Event.actions.route)</i>"}
    ioc_risk_router -- "HIGH_RISK_THREAT" --> handle_high_risk_ioc_branch["6a. handle_high_risk_ioc_branch<br/><i>(Recommend Containment)</i>"]
    ioc_risk_router -- "LOW_RISK_BENIGN" --> handle_low_risk_ioc_branch["6b. handle_low_risk_ioc_branch<br/><i>(Recommend FP / Monitor)</i>"]

    handle_high_risk_ioc_branch --> document_ioc_enrichment_node["7. document_ioc_enrichment_node<br/><i>(SOAR Comment & Report Summary)</i>"]
    handle_low_risk_ioc_branch --> document_ioc_enrichment_node

Sequence Diagram

sequenceDiagram
    participant Analyst
    participant AutomatedAgent as Automated Agent (MCP Client)
    participant EnrichIOC as skills/common/enrich-ioc/SKILL.md
    participant PivotGTI as skills/common/pivot-on-ioc-gti/SKILL.md
    participant FindCase as skills/common/find-relevant-soar-case/SKILL.md
    participant DocumentInSOAR as skills/common/document-in-soar/SKILL.md
    participant GenerateReport as skills/common/generate-report-file/SKILL.md
    participant SIEM as secops-mcp
    participant GTI as gti-mcp
    participant SOAR as secops-soar
    participant User

    Analyst->>AutomatedAgent: Start Basic IOC Enrichment v2\nInput: IOC_VALUE, IOC_TYPE, CASE_ID (opt), ...

    %% Step 2: Enrich IOC (GTI Report + SIEM Lookup + SIEM Match)
    AutomatedAgent->>EnrichIOC: Execute(Input: IOC_VALUE, IOC_TYPE)
    EnrichIOC-->>AutomatedAgent: Results: GTI_FINDINGS, SIEM_ENTITY_SUMMARY, SIEM_IOC_MATCH_STATUS

    %% Step 3: Fetch Key GTI Relationships
    Note over AutomatedAgent: Determine relevant RELATIONSHIP_NAMES (REL_LIST)
    AutomatedAgent->>PivotGTI: Execute(Input: IOC_VALUE, IOC_TYPE, RELATIONSHIP_NAMES=REL_LIST)
    PivotGTI-->>AutomatedAgent: Results: GTI_RELATIONSHIPS

    %% Step 4: Search Recent SIEM Events
    AutomatedAgent->>SIEM: search_security_events(text=IOC_VALUE, hours_back=SIEM_SEARCH_HOURS)
    SIEM-->>AutomatedAgent: Recent SIEM Events Summary (SIEM_RECENT_EVENTS)

    %% Step 5: Search Relevant SOAR Cases
    AutomatedAgent->>FindCase: Execute(Input: SEARCH_TERMS=[IOC_VALUE], CASE_STATUS_FILTER="Opened")
    FindCase-->>AutomatedAgent: Results: RELEVANT_CASE_IDS, RELEVANT_CASE_SUMMARIES (FOUND_CASES)

    %% Step 6: Synthesize Findings & Assess Risk
    Note over AutomatedAgent: Combine all findings (incl. FOUND_CASES). Guide analyst assessment (ASSESSMENT) & recommendation (RECOMMENDATION).

    %% Step 7: Conditional Documentation
    alt CASE_ID provided
        Note over AutomatedAgent: Prepare COMMENT_TEXT with all findings, assessment, recommendation
        AutomatedAgent->>DocumentInSOAR: Execute(Input: CASE_ID, COMMENT_TEXT)
        DocumentInSOAR-->>AutomatedAgent: Results: DOCUMENTATION_STATUS
    else CASE_ID not provided
        Note over AutomatedAgent: DOCUMENTATION_STATUS = "Skipped"
    end

    %% Step 8: Optional Report Generation
    AutomatedAgent->>User: Confirm: "Generate markdown report? (Yes/No)"
    User-->>AutomatedAgent: Report Choice (REPORT_CHOICE)
    alt REPORT_CHOICE is "Yes"
        Note over AutomatedAgent: Prepare REPORT_CONTENT
        AutomatedAgent->>GenerateReport: Execute(Input: REPORT_CONTENT, REPORT_TYPE="ioc_enrichment", REPORT_NAME_SUFFIX=IOC_VALUE)
        GenerateReport-->>AutomatedAgent: Results: REPORT_GENERATION_STATUS
    else REPORT_CHOICE is "No"
        Note over AutomatedAgent: REPORT_GENERATION_STATUS = "Skipped"
    end

    %% Step 9: Completion
    AutomatedAgent->>Analyst: attempt_completion(result="Basic IOC enrichment v2 complete for IOC_VALUE. Assessment: ASSESSMENT. Recommendation: RECOMMENDATION. Documentation: DOCUMENTATION_STATUS. Report: REPORT_GENERATION_STATUS.")

## Rubrics

The following rubric is used to evaluate the execution of this **Triage/Response** runbook by an LLM agent.

### Grading Scale (0-100 Points)

| Criteria | Points | Description |
| :--- | :--- | :--- |
| **Context & Enrichment** | 25 | Correctly extracted entities and enriched them with relevant context (GTI, SIEM). |
| **Analysis & Decision** | 25 | Analyzed the enriched data to make a sound decision (FP/TP, Escalate/Close). |
| **Action Execution** | 20 | Performed the required response actions (e.g., isolation, containment) correctly. |
| **Documentation** | 15 | Clearly documented findings and actions in the case/ticket. |
| **Operational Artifacts** | 15 | Produced required artifacts: Sequence diagram, execution metadata (date/cost), and summary. |

### Evaluation Criteria Details

#### 1. Context & Enrichment (25 Points)
- **10 pts**: Accurately extracted key entities (IPs, users, hashes) from the input.
- **15 pts**: Performed necessary enrichment (e.g., `enrich_ioc`) to gather reputation and history.

#### 2. Analysis & Decision (25 Points)
- **15 pts**: Interpreted the context correctly to determine the nature of the alert.
- **10 pts**: Reached a logical conclusion or next step (e.g., "Escalate to Tier 2" or "Isolate Host").

#### 3. Action Execution (20 Points)
- **10 pts**: Called the correct tools to perform response actions (if applicable) or investigative steps.
- **10 pts**: Verified the success of actions or handled errors appropriately.

#### 4. Documentation (15 Points)
- **15 pts**: Posted a comprehensive comment or update to the SOAR case summarizing the triage.

#### 5. Operational Artifacts (15 Points)
- **5 pts**: **Sequence Diagram**: Produced a Mermaid sequence diagram visualizing the steps taken.
- **5 pts**: **Execution Metadata**: Recorded the date, duration, and estimated token cost.
- **5 pts**: **Summary Report**: Generated a concise summary of the actions and outcomes.