skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

url-get-secops-threat-intel

Retrieves threat intelligence summaries for URLs using the Chronicle SecOps MCP get_threat_intel tool.

85|14|Updated May 17, 2025
Search Tags:#mcp#secops#threat intelligence#chronicle#url analysis#alert triage#indicator enrichment
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill url-get-secops-threat-intel-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: url-get-secops-threat-intel
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/url-get-secops-threat-intel
Command: npx skills add https://github.com/dandye/adk_runbooks --skill url-get-secops-threat-intel-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need external threat intelligence context when triaging suspicious URLs, especially when specialized URL analysis tools return inconclusive results. This Skill provides a standardized atomic runbook for querying Chronicle SecOps threat intelligence about a specific URL and interpreting the narrative response. ## Core Features & Use Cases - SecOps MCP Integration: Calls the secops-mcp get_threat_intel tool with a natural-language query about the target URL. - Risk Classification Logic: Applies decision rules that flag URLs as High, Medium, or Low risk based on keywords in the threat intelligence summary and optional prior GTI confidence. - Workflow Chaining: Routes results to downstream runbooks such as Chronicle SIEM searches or escalation paths based on the assessed risk level. - Use Case: During alert triage, an analyst receives a URL with unknown GTI reputation and uses this runbook to pull a SecOps threat intelligence summary, extract keywords like "phishing page", and decide whether to escalate or continue investigation. ## Quick Start Ask the agent to get SecOps threat intelligence for the URL http://suspicious-example.com and classify its risk level.

Frequently Asked Questions about url-get-secops-threat-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I get threat intelligence for a URL using SecOps MCP?▼

Call the get_threat_intel tool on the secops-mcp server with a query like "Provide threat intelligence summary for URL {url}". The tool returns a textual summary that the agent parses for risk keywords such as phishing page or malware download.

When should I use SecOps threat intel instead of a GTI URL report?▼

Use SecOps threat intelligence when you want broader narrative context or when a preceding GTI check returned unknown or inconclusive reputation. The runbook treats GTI confidence as optional input that informs how the SecOps summary is interpreted.

What inputs does the URL threat intel runbook require?▼

The runbook requires a url string, typically sourced from alert data or other tool outputs. An optional gti_confidence value from a prior GTI check can refine the risk classification when the summary is ambiguous.

How does the runbook classify URL risk from the summary?▼

The agent performs keyword analysis on the returned summary. Terms like known malicious URL or phishing page trigger a High_Risk flag, suspicious redirect or adware-related terms trigger Medium_Risk, and benign results are flagged Low_Risk with routing to Chronicle search.

What happens if the get_threat_intel tool call fails?▼

On failure the runbook logs the output_message and escalates with an error stating that SecOps threat intelligence could not be retrieved for the URL. Execution time and output status are also logged per the AI performance logging requirements.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Threat Hunting & IOC Analysis

Extract and normalize indicators of compromise from threat reports.

Official
Advanced
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
xalgordxalgord
954

analyzing-indicators-of-compromise

Enriches IOCs with multi-source threat intelligence to assign confidence scores and blocking dispositions.

Community
Intermediate
xalgordxalgord
954

implementing-email-sandboxing-with-proofpoint

Configure Proofpoint TAP sandboxing to detonate malicious email attachments and URLs.

Community
Intermediate