What problem does it solve? Security analysts need a consistent, repeatable process for triaging suspected malicious file hashes found in alerts, without performing full reverse engineering or deep forensics on every detection. ## Core Features & Use Cases - Threat Intelligence Enrichment: Retrieves GTI file reports and sandbox behavior summaries, including malware family classification, contacted IPs/domains, and MITRE TTPs. - SIEM Impact Scoping: Searches security events for process launches, file modifications, and network connections tied to the hash to identify affected hosts and users. - SOAR Documentation & Reporting: Posts synthesized findings and recommendations to the SOAR case and optionally generates a Markdown report with a Mermaid diagram. - Use Case: An alert fires on a suspicious SHA256 hash. Provide the hash and case ID, and the runbook enriches it via GTI, scopes executions in the SIEM, checks related open cases, and documents a severity assessment with containment recommendations. ## Quick Start Triage the file hash d41d8cd98f00b204e9800998ecf8427e associated with SOAR case 1234 and document the findings in the case.
