Before
Analysts likely copied indicators from threat intelligence or incident reports, switched to the security console, classified each value, and searched for existing records before creating or deleting them one at a time. They then had to return to the team conversation to share progress or results, with separate handling required for IP addresses, domains, and file hashes.
How it works
- An analyst submits a team-chat command, and the workflow identifies whether the request is to submit, remove, or view indicators.
- The flow checks for IOC data, extracts and classifies each value as an IP address, domain, MD5 hash, or SHA256 hash, and routes it to the appropriate action.
- Indicators are created, searched, or deleted in the security platform, while status updates and results are delivered back to the team-chat channel.
Workflow details
- Command intake: The workflow receives a team-chat command, extracts the requested operation and IOC values, and determines whether the user wants to submit, remove, or view indicators.
- IOC validation and classification: It checks whether indicators are present, separates them by type, and routes IP addresses, domains, MD5 hashes, and SHA256 hashes through the appropriate processing branch.
- Indicator management: For submission requests, the workflow creates the classified indicators in the endpoint security platform. For removal requests, it searches for matching indicators and deletes them by identifier.
- Visibility and updates: View requests search for matching indicators, while processing updates are posted to the team-chat channel so analysts can see the status and IOC-related information without leaving the conversation.
- Operational result: The flow replaces repeated console navigation, IOC classification, searches, and one-by-one indicator actions with a command-driven process that supports both individual and batch IOC handling.
What changed
Analysts can now issue submit, remove, or view commands from the team-chat channel, with IOC extraction, type-based routing, searches, and indicator actions performed automatically. The human decision is reduced to choosing the command and supplying the IOC data, while the resulting update is returned to the same channel.
Work removed
Opening the security console, classifying each IOC by type, searching for existing indicators, copying values between tools, creating or deleting indicators one at a time, and manually posting status updates to the team channel.
Expected outcome
The workflow is expected to remove approximately 5–10 manual actions per IOC batch, based on the documented replacement of console navigation, classification, duplicate searches, indicator changes, and status updates.
