Agent skill
correlate-ioc
Check for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations. Takes IOC list and returns related alerts and cases.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/correlate-ioc
SKILL.md
Correlate IOC Skill
Check for existing SIEM alerts and cases related to specific Indicators of Compromise.
Inputs
IOC_LIST- Single IOC or list of IOCs (e.g.,["198.51.100.10", "evil-domain.com"])- (Optional)
TIME_FRAME_HOURS- Lookback period for SIEM alerts (default: 168 = 7 days) - (Optional)
SOAR_CASE_FILTER- Additional filter for SOAR cases (e.g.,status="OPEN")
Workflow
Step 1: Correlate SIEM Alerts
Search for alerts containing any IOC in the list:
secops-mcp.get_security_alerts(
query=IOC_based_query,
hours_back=TIME_FRAME_HOURS
)
Store summary in RELATED_SIEM_ALERTS:
- Alert count
- Alert types/names
- Severity distribution
- Affected assets
Step 2: Correlate Cases
Search for cases containing any IOC:
secops-soar.list_cases(
filter=IOC_based_filter + SOAR_CASE_FILTER
)
Store summary in RELATED_SOAR_CASES:
- Case IDs and names
- Case status
- Case priority
Required Outputs
After completing this skill, you MUST report these outputs:
| Output | Description |
|---|---|
RELATED_SIEM_ALERTS |
Summary of SIEM alerts related to the IOC(s) |
RELATED_CASES |
Summary of cases related to the IOC(s) |
CORRELATION_STATUS |
Success/failure status of the correlation |
MALICIOUS_CONFIDENCE |
Derived confidence based on alert history: high, medium, low, or none |
Use Cases
- Before Investigation - Check if IOC is already under investigation
- During Enrichment - Understand internal activity for an IOC
- Threat Hunt - Find all alerts/cases related to campaign indicators
- Incident Response - Identify scope of compromise across cases
Correlation Summary Template
IOC Correlation Summary for [IOC_LIST]:
SIEM Alerts (last [TIME_FRAME_HOURS] hours):
- Total alerts: [count]
- Alert types: [list]
- Affected hosts: [list]
Related Cases:
- Open cases: [count] - [IDs]
- Closed cases: [count]
- Related investigations: [summary]
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?