Ioc Enrichment

Q: Why use Ioc Enrichment on TypingMind?

Because you install it once and use it with any model. Ioc Enrichment is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

Q: How do I install Ioc Enrichment in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/gensecaihq/Wazuh-Autopilot/tree/main/backend/app/skills/ioc-enrichment. TypingMind reads its SKILL.md and installs it as a skill you can enable per chat.

Q: Which AI models can use Ioc Enrichment?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

Q: How many AI models can I use with Ioc Enrichment?

As many as you like. As long as a model supports skills, you can use Ioc Enrichment with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Q: Is the Ioc Enrichment AI skill free?

Yes. It is published on GitHub by gensecaihq under the MIT license. You only pay your own AI provider for the tokens you use.

Q: What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

Q: How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

Organization

gensecaihq

ioc-enrichment

Enrich indicators (IPs, domains, URLs, hashes) with reputation and context, grade source reliability with the Admiralty Code, and respect TLP and data-egress rules; use when a case contains external indicators.

Overview

Publisher	gensecaihq
Repository	`Wazuh-Autopilot`
Skill name	`ioc-enrichment`
Stars	61
Forks	15
Bundled files	Instructions only
License	MIT
Links	Skill source Repository Homepage

Markdown instructions
A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.
Works with any LLM
AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.
Self-contained
Everything the model needs lives in the instructions — no extra files to sync.
Open source
Published by gensecaihq on GitHub. Read the source before you install it.

Installation

Install the Ioc Enrichment AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
https://github.com/gensecaihq/Wazuh-Autopilot/tree/main/backend/app/skills/ioc-enrichment
Enable the skill in any chat where you want it available.

Store

Installed

Skills

Add skills

Import one or more skills from a public GitHub folder or a local .skill or .zip archive, or SKILL.md file.

From GitHub URLFrom .skill, .zip, or SKILL.md

GitHub repo or folder

https://github.com/gensecaihq/Wazuh-Autopilot/tree/main/backend/app/skills/ioc-enrichment

Points to a single skill folder, or any folder that contains multiple skills. Public repos only.

CancelContinue

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/gensecaihq/Wazuh-Autopilot.git /tmp/Wazuh-Autopilot
mkdir -p .claude/skills
cp -r /tmp/Wazuh-Autopilot/backend/app/skills/ioc-enrichment .claude/skills/ioc-enrichment

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Ioc Enrichment in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Ioc Enrichment on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Ioc Enrichment is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed
The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.
Switch models mid-chat
Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

IOC Enrichment

Turn raw indicators into decisions: block, watch, or ignore. NIST CSF 2.0 ID.RA (threat intelligence informs risk) and DE.AE (context for adverse events).

Procedure

get_case — list indicators with role attacker or observed that are public: public IPs, internet domains, URLs, file hashes.
For each (max 20 per run, attacker-role first):
- check_ioc_reputation(indicator=...) — reputation verdict and sources.
- analyze_security_threat(indicator=..., indicator_type=...) — threat context.
- search_security_events(query=<indicator>, srcip=<ip>, time_range="7d") — internal sightings (how many hosts?). For hashes, check whether the Wazuh VirusTotal integration already scored the file: rule 87105 (level 12) means positives were found; rule 87104 means none; rules 87101, 87102 are integration errors (rate limit, credentials), not verdicts. get_wazuh_alerts(rule_groups=["virustotal"]) lists them. Load wazuh-malware-detection for detail.
Optionally search_external_context for public reporting — see egress rules.
Grade each source with the Admiralty Code; combine into a verdict.

Egress rules for search_external_context

search_external_context sends the query outside the environment (third-party web search). Only send:

Public IPs, public domains/URLs, file hashes, CVE ids, malware/actor names.

Never send: internal hostnames, internal IPs (RFC 1918 etc.), usernames, email addresses, case ids, customer names, file paths, or raw log lines. If unsure, don't send. Respect TLP: indicators received as TLP:RED or TLP:AMBER+STRICT must not be queried externally.

Admiralty Code (NATO / STANAG 2511)

Source reliability: A completely reliable · B usually reliable · C fairly reliable · D not usually reliable · E unreliable · F cannot be judged. Information credibility: 1 confirmed by other sources · 2 probably true · 3 possibly true · 4 doubtful · 5 improbable · 6 cannot be judged.

Typical grading: commercial/curated feed with history → B; single open-source blocklist → C; one-off paste or forum post → D/F. Internal Wazuh sightings of confirmed attacks → A1.

Pyramid of Pain (value of blocking)

Hash values (trivial for attacker to change) < IP addresses < Domain names < Network/host artifacts < Tools < TTPs (hardest to change). Prefer recommending detections on artifacts/TTPs; treat IP blocks as short-lived (24h–7d).

Verdict per indicator

Verdict	Criteria	Recommendation
malicious	≥ 1 reliable (A/B) source rates malicious, or confirmed internal attack	block (time-bound), hunt for other sightings
suspicious	only C/D sources, or behaviour-only	watch; include in detection review
benign	known CDN / cloud provider / business partner with clean history	do not block; note shared-infrastructure risk
unknown	no data	rely on behavioural evidence

Shared infrastructure warning: cloud/CDN IPs (large providers) host many tenants — blocking them can cause outages; state this explicitly.

Output

add_entities updating each indicator's enrichment: verdict, sources with Admiralty grade, first/last seen internally, internal host count, TLP.
add_finding titled IOC enrichment with the per-indicator table and recommendation. standard_refs: NIST-CSF-2:ID.RA, NIST-CSF-2:DE.AE.
update_case confidence if intelligence materially changes it.

Frequently asked questions

What does the Ioc Enrichment AI skill do?

Why use Ioc Enrichment on TypingMind?

Because you install it once and use it with any model. Ioc Enrichment is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Ioc Enrichment in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/gensecaihq/Wazuh-Autopilot/tree/main/backend/app/skills/ioc-enrichment. TypingMind reads its SKILL.md and installs it as a skill you can enable per chat.

Which AI models can use Ioc Enrichment?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Ioc Enrichment?

As many as you like. As long as a model supports skills, you can use Ioc Enrichment with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Ioc Enrichment AI skill free?

Yes. It is published on GitHub by gensecaihq under the MIT license. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

View all

Quarkus Patterns

affaan-m

CommunityPopular

Patrones de arquitectura Quarkus 3.x LTS con Camel para mensajería, diseño de API RESTful, servicios CDI, acceso a datos con Panache y procesamiento asíncrono.

Quarkus Security

Buenas prácticas de seguridad en Quarkus para autenticación, autorización, JWT/OIDC, RBAC, validación de entrada, CSRF, gestión de secretos y seguridad de dependencias.

Quarkus Verification

Bucle de verificación para proyectos Quarkus: build, análisis estático, pruebas con cobertura, escaneos de seguridad, compilación nativa y revisión de diff antes del lanzamiento o PR.

Springboot Security

Buenas prácticas de Spring Security para autenticación/autorización, validación, CSRF, secretos, cabeceras, limitación de velocidad y seguridad de dependencias en servicios Java Spring Boot.

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

IOC Enrichment

Procedure

Egress rules for search_external_context

Admiralty Code (NATO / STANAG 2511)

Pyramid of Pain (value of blocking)

Verdict per indicator

Output

Frequently asked questions

Related AI Skills

Set up your own AI workspace now