threat-report-evaluation

What this skill does

# Threat Report Evaluation & IOC Analysis

Systematically evaluate threat reports to determine organizational impact and create comprehensive defense-in-depth detections.

---

## LimaCharlie Integration

> **Prerequisites**: Run `/init-lc` to initialize LimaCharlie context.

### LimaCharlie CLI Access

All LimaCharlie operations use the `limacharlie` CLI directly:

```bash
limacharlie <noun> <verb> --oid <oid> --output yaml [flags]
```

For command help and discovery: `limacharlie <command> --ai-help`

### Critical Rules

| Rule | Wrong | Right |
|------|-------|-------|
| **CLI Access** | Call MCP tools or spawn api-executor | Use `Bash("limacharlie ...")` directly |
| **Output Format** | `--output json` | `--output yaml` (more token-efficient) |
| **Filter Output** | Pipe to jq/yq | Use `--filter JMESPATH` to select fields |
| **LCQL Queries** | Write query syntax manually | Use `limacharlie ai generate-query` first |
| **D&R Rules** | Write YAML manually | Use `limacharlie ai generate-detection` + `limacharlie dr validate` |
| **Timestamps** | Calculate epoch values | Use `date +%s` or `date -d '7 days ago' +%s` |
| **OID** | Use org name | Use UUID (call `limacharlie org list` if needed) |

---

## Architecture

This skill uses specialized sub-agents to reduce context usage and enable parallel processing:

```
Main Skill (Orchestrator)
├── Phase 0: Download report to /tmp/ (keeps content out of main context)
├── Phase 1: Spawn threat-report-parser → Get structured IOCs/behaviors
├── Phase 2: Platform check (lightweight API call)
├── Phase 3: Spawn ioc-hunter agents (parallel, one per org)
├── Phase 4: Spawn behavior-hunter agents (parallel, one per org)
├── Phase 5: User checkpoint - present findings
├── Phase 6: Spawn detection-builder agents (parallel, by layer)
├── Phase 7: User approval - confirm rules to deploy
├── Phase 8: Deploy approved rules
└── Phase 9: Generate final report from aggregated summaries
```

## Critical Principles

- Extract IOCs and behaviors ONLY from the provided report
- Search ONLY in the specified LimaCharlie organization(s)
- NEVER fabricate or assume data not present
- Ask for user confirmation before creating any resources
- Use sub-agents for context-heavy operations

## Required Information

Before starting, obtain:
- **Threat Report**: URL, PDF, or text
- **Organization ID (OID)**: Target LimaCharlie org (or multiple for parallel hunting)
- **Time Window**: Search depth (default: 7 days for behaviors, 30 days for IOCs)

---

## Phase 0: Download Report (if URL provided)

**IMPORTANT**: Before spawning the parser agent, download the report to a local file. This keeps the report content out of the main context and allows sub-agents to process it independently.

### For URL reports:

```bash
# Download HTML/web reports
curl -sL "https://example.com/threat-report.html" -o /tmp/threat_report.html

# Download PDF reports
curl -sL "https://example.com/report.pdf" -o /tmp/threat_report.pdf
```

### For storage URLs (cloud-hosted PDFs):

```bash
# Google Cloud Storage
curl -sL "https://storage.googleapis.com/bucket/report.pdf" -o /tmp/threat_report.pdf

# S3 (public)
curl -sL "https://bucket.s3.amazonaws.com/report.pdf" -o /tmp/threat_report.pdf
```

**Important Notes**:
- Always use `/tmp/` for downloaded files
- Use `-sL` flags to follow redirects silently
- Pass the **file path** (not URL) to the parser agent
- The parser agent uses `Read` tool which handles PDFs natively

---

## Phase 1: Parse Threat Report

Spawn the `threat-report-parser` agent to extract all IOCs and behaviors. Always pass the **local file path** from Phase 0 (not the original URL).

```
Task(
  subagent_type="lc-essentials:threat-report-parser",
  prompt="Parse threat report and extract all IOCs and behaviors:

Report Source: /tmp/threat_report.pdf
Report Type: pdf"
)
```

**Agent returns structured JSON with**:
- Report metadata (title, author, threat name)
- IOCs categorized by type (hashes, domains, IPs, paths, etc.)
- Behaviors with MITRE ATT&CK mappings
- Platform requirements

**Display to user**: Summary of extracted IOCs and behaviors with counts.

---

## Phase 2: Platform Check

Use a lightweight API call to verify platforms exist in target org(s).

```bash
limacharlie event types --oid <oid> --output yaml
```

Filter IOCs and behaviors to matching platforms only.

---

## Phase 3: IOC Hunting (Parallel)

Spawn one `ioc-hunter` agent per organization. For multi-org scenarios, spawn all agents in a SINGLE message for parallel execution.

```
Task(
  subagent_type="lc-essentials:ioc-hunter",
  prompt="Search for IOCs in organization '{org_name}' (OID: {oid})

IOCs:
{iocs_json}

Time Window: 30 days"
)
```

**Spawn multiple in parallel for multi-org**:
```
# Single message with multiple Task calls = parallel execution
Task(subagent_type="lc-essentials:ioc-hunter", prompt="...org1...")
Task(subagent_type="lc-essentials:ioc-hunter", prompt="...org2...")
Task(subagent_type="lc-essentials:ioc-hunter", prompt="...org3...")
```

**Agent returns**:
- Findings classified by severity (critical/high/moderate/low)
- Affected sensors with hostnames
- IOCs not found

---

## Phase 4: Behavior Hunting (Parallel)

Spawn one `behavior-hunter` agent per organization.

```
Task(
  subagent_type="lc-essentials:behavior-hunter",
  prompt="Search for behaviors in organization '{org_name}' (OID: {oid})

Behaviors:
{behaviors_json}

Platforms Available: {platforms}
Time Window: 7 days"
)
```

**Agent returns**:
- Behaviors found with sample events (max 5 per behavior)
- LCQL queries used
- Classification by event count

---

## Phase 5: User Checkpoint

Present aggregated findings to user:

```markdown
## IOC Hunt Results

### Critical Findings (Immediate Investigation)
- [IOC type]: [value] - Found on [X] sensors

### High Priority Findings
- ...

### No Findings
- [X] IOCs searched, [Y] not found

## Behavior Hunt Results

### Suspicious Activity Detected
- [Behavior]: [X] events on [Y] sensors
  - Sample: [hostname]: [command_line]

### No Activity Detected
- ...

## Affected Sensors Summary
| Hostname | IOC Hits | Behavior Hits | Action Required |
|----------|----------|---------------|-----------------|
```

**Ask user**: "Continue with detection creation? Which layers are needed?"

---

## Phase 6: Detection Building (Parallel by Layer)

Based on findings and user input, spawn `detection-builder` agents for each detection layer.

**Detection Layers**:
1. **process** - Process execution, command-line, parent-child
2. **network** - DNS, connections, HTTP patterns
3. **file** - File creation, hash matching
4. **persistence** - Registry, scheduled tasks, services
5. **credential** - Credential dumping, priv-esc tools
6. **lateral** - Remote execution, authentication
7. **evasion** - Log clearing, masquerading
8. **stateful** - Chained detections, thresholds
9. **lookup** - IOC lookup matching rules
10. **fp_management** - False positive exclusions

```
Task(
  subagent_type="lc-essentials:detection-builder",
  prompt="Build detections for layer 'process' in organization '{org_name}' (OID: {oid})

Threat Name: {threat_name}

Detection Requirements:
{detection_requirements_json}"
)
```

**Spawn layers in parallel**:
```
Task(subagent_type="lc-essentials:detection-builder", prompt="...layer: process...")
Task(subagent_type="lc-essentials:detection-builder", prompt="...layer: network...")
Task(subagent_type="lc-essentials:detection-builder", prompt="...layer: file...")
```

**Agent returns**:
- Validated D&R rules ready for deployment
- Validation failures with error details

---

## Phase 7: User Approval

Present all generated rules for approval:

```markdown
## Generated Detection Rules

### Process Detections (5 rules)
| Rule Name | MITRE | Priority | Status |
|-----------|-------|----------|--------|
| apt-x-process-encoded-powershell | T1059.001 | 8 | validated |

### Network Detections (3 rules)
| Rule Name | MITRE | Priority | Status |
|-----------|-