ioc-enrichment
From the author
Enrich indicators (IPs, domains, URLs, hashes) with reputation and context, grade source reliability with the Admiralty Code, and respect TLP and data-egress rules; use when a case contains external indicators.
Install
npx skills add gensecaihq/Wazuh-Autopilot --skill ioc-enrichment -a claude-code
Installs to .claude/skills/ioc-enrichment/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 80
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- hunt-ioctonone-ai/tononeAnalyze indicators of compromise — enrichment, attribution, and response recommendations. Use when asked to "analyze these IOCs", "enrich these indicators", or "what is this hash".Other★ 76
- performing-ioc-enrichment-automation26zl/cybersec-toolkitAutomates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.Finance★ 82
- automating-ioc-enrichment26zl/cybersec-toolkitAutomates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.Engineering★ 82
- lead-enrichmentgooseworks-ai/goose-skillsEnrich leads with email, phone, company data using multiple data sourcesProductivity★ 1.3K
- data-enrichmentsandbaseai/sandbase-skillsEnrich any entity — companies, domains, emails, or people — with verified data from multiple sources. Combines Apollo, Strale, LinkedIn, and Akta data to fill gaps in your CRM, lead databases, or research datasets with production-quality enrichment.Science★ 203
- analyzing-indicators-of-compromise26zl/cybersec-toolkitAnalyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.Security★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in