Enrich IOC Skill

Perform standardized enrichment for a single Indicator of Compromise (IOC) using Google Threat Intelligence (GTI) and Chronicle SIEM.

Inputs

• IOC_VALUE - The indicator value (e.g., "198.51.100.10", "evil-domain.com", "abcdef123456...", "http://bad.url/path";)
• IOC_TYPE - The type: "IP Address", "Domain", "File Hash", or "URL"

Workflow

Step 1: GTI Enrichment

Based on IOC_TYPE, call the appropriate GTI tool:

Store key findings in GTI_FINDINGS:

• Reputation score
• Classification (malicious, suspicious, clean)
• Key relationships (contacted domains, IPs, etc.)
• Associated malware families or campaigns

Error Handling: If GTI fails (quota exceeded, IOC not found), note the limitation and proceed with SIEM enrichment.

Step 2: SIEM Entity Lookup

secops-mcp.lookup_entity(entity_value=IOC_VALUE)

Store in SIEMENTITYSUMMARY:

• First/last seen timestamps
• Related alerts
• Associated assets/users

Step 3: SIEM IOC Match Check

secops-mcp.get_ioc_matches()

Check if IOCVALUE appears in results. Store Yes/No in SIEMIOCMATCHSTATUS.

Required Outputs

After completing this skill, you MUST report these outputs:

Quick Reference

GTI Tools:

• getipaddressreport(ipaddress)
• getdomainreport(domain)
• getfilereport(hash)
• geturlreport(url)

SIEM Tools:

• lookupentity(entityvalue)
• getiocmatches()