correlate-ioc - Correlate IOC with Existing Security Alerts and Cases
Check for existing SIEM alerts and case management entries related to Indicators of Compromise
Tags
Updated: 2026-02-12Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Search SIEM alerts
- Search case management entries
- Summarize correlation results
- Calculate malicious confidence
Inputs
- IOC list
- Time frame parameter
- Case filter parameter
- SIEM query
- Case filter
Outputs
- SIEM alert summary
- Case summary
- Correlation status
- Malicious confidence level
Requirements
- Chronicle viewer role
- SOAR editor role
- Security analysis personas