skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

domain-get-secops-threat-intel

Retrieve Chronicle SecOps threat intelligence summaries and IOC matches for a domain.

85|14|Updated May 17, 2025
Search Tags:#incident response#threat intelligence#ioc#alert triage#domain enrichment#chronicle secops#secops-mcp
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill domain-get-secops-threat-intel-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-get-secops-threat-intel
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/domain-get-secops-threat-intel
Command: npx skills add https://github.com/dandye/adk_runbooks --skill domain-get-secops-threat-intel-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need external threat intelligence context when triaging domains or FQDNs found in alerts, but manually querying Chronicle SecOps for each indicator is slow and inconsistent. This Skill standardizes the retrieval of threat intelligence summaries and IOC matches via the secops-mcp get_threat_intel tool. ## Core Features & Use Cases - Threat Intel Retrieval: Queries the Chronicle secops-mcp get_threat_intel tool with a natural-language query for any domain or FQDN. - Risk Classification: Applies keyword-based decision logic to flag domains as High_Risk, Medium_Risk, or Low_Risk based on the returned summary. - Workflow Integration: Accepts optional GTI confidence context from prior checks and routes results to follow-on runbooks like entity lookup or escalation. - Use Case: During alert triage, an analyst receives a suspicious domain. After an inconclusive GTI check, this Skill pulls the SecOps threat intel summary, extracts keywords like "phishing campaign", and flags the domain for containment. ## Quick Start Get the Chronicle SecOps threat intelligence summary for the domain evil-example.com and classify its risk level.

Frequently Asked Questions about domain-get-secops-threat-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I get threat intelligence for a domain in Chronicle SecOps?▼

Use the secops-mcp get_threat_intel tool with a query like "Provide threat intelligence summary for domain {domain_name}". The tool returns a textual summary that can be parsed for risk keywords such as "malware C2" or "phishing site".

How to triage a suspicious domain using SecOps MCP tools?▼

Start with a GTI report check, then call get_threat_intel for broader narrative context. Classify the domain as High, Medium, or Low risk based on keywords in the summary, then proceed to entity lookup or escalation runbooks.

When should I use get_threat_intel instead of a GTI domain report?▼

Use get_threat_intel when you need broader narrative context or when the specialized GTI report is inconclusive. It also works as a follow-up when GTI confidence is medium and correlation with SecOps intelligence is needed.

What inputs does the SecOps threat intel lookup require?▼

It requires a domain_name string, typically sourced from an alert field or prior enrichment output. An optional gti_confidence value from a preceding GTI check can be supplied to inform interpretation of the summary.

What happens if the get_threat_intel tool call fails?▼

On failure, the runbook logs the output_message and escalates to a human analyst with a note that threat intelligence retrieval failed for the domain. No automated risk classification is applied in the failure path.

Related Skills

Explore More Software Engineering Skills→
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-indicators-of-compromise

Consolidate VirusTotal, AbuseIPDB, and MalwareBazaar results into a unified confidence score and disposition.

Community
Intermediate
YoursshLabsYoursshLabs
38

yourssh-refactor-sweep

Identifies and applies safe, behavior-preserving refactors to the YourSSH Flutter codebase.

Official
Advanced
kanopikanopi
16

code-standards-checker

Detect project type and run PHPCS or ESLint to report coding standard violations.

Official
Intermediate