pivot-on-ioc
Explore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.
安装与使用
请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。
查看来源 ↗使用指南技能说明
Pivot on IOC Skill
Explore relationships connected to an IOC within Google Threat Intelligence (GTI) to discover related entities for investigation expansion.
Inputs
-
IOC_VALUE- The indicator value to pivot from -
IOC_TYPE- The type: "IP Address", "Domain", "File Hash", "URL", or "Collection" -
RELATIONSHIP_NAMES- List of relationships to query (see table below)
Available Relationships by IOC Type
| IOC Type | Common Relationships |
|---|---|
| IP Address | communicating_files, downloaded_files, referrer_files, resolutions |
| Domain | resolutions, communicating_files, downloaded_files, subdomains, siblings |
| File Hash | contacted_domains, contacted_ips, contacted_urls, dropped_files, embedded_domains |
| URL | communicating_files, downloaded_files, last_serving_ip_address |
| Collection | malware_families, attack_techniques, threat_actors, indicators |
Workflow
Step 1: Select GTI Tool
Based on IOC_TYPE:
| IOC Type | Tool |
|---|---|
| IP Address | gti-mcp.get_entities_related_to_an_ip_address |
| Domain | gti-mcp.get_entities_related_to_a_domain |
| File Hash | gti-mcp.get_entities_related_to_a_file |
| URL | gti-mcp.get_entities_related_to_an_url |
| Collection | gti-mcp.get_entities_related_to_a_collection |
Step 2: Query Each Relationship
For each relationship in RELATIONSHIP_NAMES:
[selected_tool](
identifier=IOC_VALUE,
relationship_name=relationship
)
Store results keyed by relationship name.
Required Outputs
After completing this skill, you MUST report these outputs:
| Output | Description |
|---|---|
RELATED_ENTITIES |
Dictionary of entities found per relationship |
EXPANDED_IOCS |
Flattened list of all discovered IOCs (IPs, domains, hashes) |
THREAT_CONTEXT |
Threat actor/campaign context if found during pivoting |
PIVOT_STATUS |
Success/failure status of the pivoting |
Example Usage
File Hash Investigation:
IOC_VALUE: "abcdef123456..."
IOC_TYPE: "File Hash"
RELATIONSHIP_NAMES: ["contacted_domains", "contacted_ips", "dropped_files"]
Domain Investigation:
IOC_VALUE: "suspicious-domain.com"
IOC_TYPE: "Domain"
RELATIONSHIP_NAMES: ["resolutions", "communicating_files", "subdomains"]
使用示例
查看来源仓库中的使用示例与配置说明。
查看来源 ↗来源历史
- 收录时间
- 2026-03-11
- 索引更新时间
- 2026-03-11
- Branch
- main
收录与同步日期属于本站记录。源码修改历史请查看来源仓库。
GitHub ↗chat Comments (0)
Sign in to join the discussion and leave a comment.
No comments yet. Be the first to share your thoughts!