Hunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation.
Proactively hunt for specific Indicators of Compromise (IOCs) across the environment based on threat intelligence feeds, recent incidents, or emerging threats.
IOC_LIST - Comma-separated list of IOC values to huntIOC_TYPES - Corresponding types (e.g., "IP Address, Domain, File Hash")HUNT_TIMEFRAME_HOURS - Lookback period (default: 96)HUNT_CASE_ID - SOAR case for trackingREASON_FOR_HUNT - Why these IOCs are being huntedParse IOC_LIST and IOC_TYPES into structured list.
Validate IOC formats (IP regex, hash length, etc.).
secops-mcp.get_ioc_matches(hours_back=HUNT_TIMEFRAME_HOURS)
Check if any IOCs appear in integrated threat feeds.
For each IOC, construct appropriate UDM query:
IP Address:
(principal.ip = "IOC" OR target.ip = "IOC" OR network.ip = "IOC")
Domain:
(principal.hostname = "IOC" OR target.hostname = "IOC" OR network.dns.questions.name = "IOC")
File Hash:
(target.file.sha256 = "IOC" OR target.file.md5 = "IOC" OR target.file.sha1 = "IOC")
URL:
target.url = "IOC"
Execute each search:
secops-mcp.search_security_events(text=query, hours_back=HUNT_TIMEFRAME_HOURS)
For each search result:
If hits found for an IOC:
Use /enrich-ioc for the IOC itself.
For involved entities (hosts, users):
secops-mcp.lookup_entity(entity_value=ENTITY)
Use /document-in-case (if HUNT_CASE_ID provided):
IOC Hunt Summary:
- IOCs Hunted: [list]
- Timeframe: [hours]
- Queries Used: [list with results summary]
- IOCs with Hits: [list with details]
- IOCs with No Hits: [list - confirms environment is clean]
- Enrichment: [for hits]
- Recommendations: [next steps]
Confirmed malicious activity: → Create/update incident case → Trigger appropriate response runbook
No significant findings: → Document hunt completion → Note clean IOCs for future reference
# IOC Hunt Results
**Hunt Date:** [timestamp]
**Timeframe:** Last [X] hours
**Reason:** [REASON_FOR_HUNT]
## IOCs Searched
| IOC | Type | Result | Notes |
|-----|------|--------|-------|
| 198.51.100.10 | IP | NO HITS | Clean |
| evil.com | Domain | 3 HITS | DNS lookups from HOST1 |
## Hits Analysis
[Details for each IOC with hits]
## Recommendations
[Actions to take]
After completing this skill, you MUST report these outputs:
| Output | Description |
|---|---|
MATCHES | IOCs found in SIEM (list of IOCs with hits) |
MATCH_CONTEXT | Context for each match (events, assets, users affected) |
MATCHES_FOUND | Boolean: true if any IOCs found in environment, false otherwise |