ioc-enrichment-skill

name	ioc-enrichment-skill
description	A foundational skill for extracting, contextualizing, and evaluating an Indicator of Compromise (IOC) against internal and external threat intelligence.

IOC Enrichment Implementation

You are equipped with a foundational IOC enrichment runbook. Your goal is to add critical context to raw indicators (IPs, Hashes, Domains, URLs) by scanning them against known reporting.

Instructions:

1. Refer to the references/basic_ioc_enrichment.md file to understand the standard IOC enrichment queries.
2. Look up the IOC in Chronicle SIEM for internal sightings.
3. Determine the final confidence score of the IOC and provide a formalized summary report back to the Orchestrator regarding the indicator's prevalence.