What problem does it solve? Security analysts often need broader narrative threat intelligence on a file hash beyond what specialized reputation tools return. This Skill queries the Chronicle secops-mcp get_threat_intel tool to obtain a textual threat intelligence summary for any MD5, SHA1, or SHA256 hash, serving as a supplementary check or fallback when other lookups yield no results. ## Core Features & Use Cases - Hash Threat Intel Lookup: Queries the secops-mcp get_threat_intel tool with a natural-language prompt built from the target file hash. - Keyword Extraction: Guides the AI agent to parse the returned summary for indicators such as "malware", "dropper", or "benign utility". - Risk-Based Decision Logic: Classifies the hash as High, Medium, or Low risk based on summary content and optional prior GTI confidence, then routes to the next Chronicle entity lookup runbook. - Use Case: During incident triage, a GTI reputation check on a SHA256 hash returns "Unknown_Reputation_GTI". Use this Skill to pull a SecOps threat intelligence summary, flag the hash as Medium risk, and proceed to a Chronicle entity lookup. ## Quick Start Ask the agent to retrieve SecOps threat intelligence for the file hash and classify its risk level based on the summary.
