IOC Threat Hunt Skill

Proactively hunt for specific Indicators of Compromise (IOCs) across the environment based on threat intelligence feeds, recent incidents, or emerging threats.

Inputs

• IOC_LIST - Comma-separated list of IOC values to hunt
• IOC_TYPES - Corresponding types (e.g., "IP Address, Domain, File Hash")
• HUNT_TIMEFRAME_HOURS - Lookback period (default: 96)
• (Optional) HUNT_CASE_ID - SOAR case for tracking
• (Optional) REASON_FOR_HUNT - Why these IOCs are being hunted

Workflow

Step 1: Parse and Validate IOCs

Parse IOC_LIST and IOC_TYPES into structured list. Validate IOC formats (IP regex, hash length, etc.).