Deep Dive IOC Analysis Skill

Perform exhaustive analysis of a single, potentially critical Indicator of Compromise escalated from Tier 1 or identified during an investigation.

Inputs

• IOC_VALUE - The IOC to analyze (IP, domain, hash, or URL)
• IOC_TYPE - The type: "IP Address", "Domain", "File Hash", or "URL"
• CASE_ID - case ID for documentation (optional)
• TIME_FRAME_HOURS - Lookback period (default: 168 = 7 days)

Workflow

Step 1: Get Case Context (if CASE_ID provided)

secops-soar.get_case_full_details(case_id=CASE_ID)