agentsclimarketplace
Sign in

Pivoting on iocs across data sources

Skill meltedinhex/analyst-ai-pack/skills/pivoting-on-iocs-across-data-sources

Pivots on indicators of compromise across multiple data sources by correlating a seed set of IOCs against logs to find co-occurring indicators, hosts, and timeframes that expand the investigation. Activates for requests to pivot on IOCs, correlate indicators across data sources, or expand an investigation from a seed indicator set.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill pivoting-on-iocs-across-data-sources

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, 437 tokens by cl100k_base, as published. Nobody here has run it

Pivoting on IOCs Across Data Sources

When to Use

  • You have a seed set of IOCs (IPs, domains, hashes, URLs) and multiple log sources, and you want to find co-occurring indicators, affected hosts, and the activity timeframe.
  • You are expanding an investigation from initial indicators to the full scope.

Do not use raw, undeduplicated matching that floods on common indicators — anchor pivots on the specific seed set and report co-occurrence, not every mention.

Prerequisites

  • A seed IOC list and one or more log sources (CSV/JSON) containing indicator fields.

Workflow

Step 1: Match seeds and gather co-occurrence

python scripts/analyst.py pivot --seeds iocs.txt --logs events.csv

Finds log records matching any seed IOC, then reports the hosts, additional indicators, and time range co-occurring with the seeds.

Step 2: Rank new indicators

Surface newly co-occurring indicators (not in the seed set) ranked by how often they appear alongside seeds — candidates to add to the IOC set.

Step 3: Confirm and expand

Validate promising new indicators and re-run the pivot to widen scope iteratively.

Step 4: Document

Record matched hosts, the timeframe, and the expanded indicator set; defang in output.

Validation

  • Matches are anchored to the seed IOC set.
  • Co-occurring hosts/indicators and the time range are reported.
  • New indicators are ranked by co-occurrence with seeds; output is defanged.

Pitfalls

  • Common indicators (shared CDNs, OS update hosts) inflating co-occurrence — exclude allow-listed.
  • Field/format mismatches (IP vs CIDR, defanged vs plain) missing matches.
  • Time-zone inconsistencies skewing the activity window.

References

What ships with it: 3 files

4.8 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.