ioc-tracker

Correlate indicators of compromise across multiple hosts from CSV data.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/mgreen27/dfir-skills --skill ioc-tracker
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ioc-tracker
Source: https://github.com/mgreen27/dfir-skills/tree/main/skills/ioc-tracker
Command: npx skills add https://github.com/mgreen27/dfir-skills --skill ioc-tracker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill consolidates and monitors Indicators of Compromise across multiple hosts within a single investigation, enhancing visibility into adversary activity.

Core Features & Use Cases

  • Indicator Collection: Tracks filenames, hashes, IP addresses, and registry paths across hosts.
  • Cross-Host Correlation: Compares and promotes critical indicators between systems to identify related malicious activity.
  • Use Case: An analyst finds suspicious process hashes on one machine and promotes them to the cross-host tracker to verify their presence elsewhere in the environment.

Quick Start

Use the ioc-tracker skill to add relevant artifacts from the current investigation and compare indicators across hosts to identify correlated malicious activity.

Frequently Asked Questions about ioc-tracker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I track indicators of compromise across multiple hosts during incident response?▼

To track indicators of compromise across multiple hosts, you can collect and correlate artifacts like filenames, hashes, and IP addresses to identify related malicious activity within an investigation.

Can I import CSV indicator data to check for malicious activity on other machines?▼

Yes, you can process CSV indicator data to update cross-host reference records, allowing you to evaluate the presence of suspicious artifacts on other machines in the environment.

What types of artifacts can I correlate for cross-host threat tracking?▼

Cross-host threat tracking supports correlating filenames, hashes, IP addresses, and registry paths across systems to ensure comprehensive adversary awareness during incident response.

How do I promote suspicious process hashes found on one machine to check other systems?▼

You can promote suspicious process hashes from a single machine to the cross-host tracker to verify their presence elsewhere, ensuring a coordinated incident response effort across the environment.

Does cross-host indicator correlation enrich findings for better adversary understanding?▼

Yes, cross-host indicator correlation enriches findings by comparing and promoting critical indicators between systems, which enhances overall visibility into adversary activity and threat awareness.