correlate-ioc - Correlate IOC with existing security alerts and cases
Check for existing SIEM alerts and case management entries related to Indicators of Compromise
Tags
Updated: 2026-02-13Capabilities
Typical Inputs
Typical Outputs
What this skill does
- search for SIEM alerts
- search for SOAR cases
- correlate IOCs with alerts
- correlate IOCs with cases
- report correlation status
Inputs
- IOC list
- time frame parameter
- SOAR case filter
Outputs
- related SIEM alerts summary
- related cases summary
- correlation status
- malicious confidence score
Requirements
- chronicle.viewer role
- chronicle.editor role
- SIEM system access
- SOAR system access