correlate-ioc

Check for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations. Takes IOC list and returns related alerts and cases.

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/correlate-ioc/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Well-structured and concise, but the workflow uses placeholder query/filter expressions and lacks validation checkpoints for what is a batch IOC operation. Tightening placeholders into executable examples and adding verification/error-handling steps would raise actionability and workflow clarity.

Suggestions

Replace placeholders like 'query=IOC_based_query' and 'IOC_based_filter' with concrete, copy-paste-ready query construction examples for the listed IOC types.

Add validation/verification checkpoints between and after the two correlation steps (e.g., check for empty results, handle API errors, confirm alert/case counts before summarizing).

Specify how MALICIOUS_CONFIDENCE is derived from alert history (the mapping rule), since it is a required output but its computation is not described in the workflow.

Dimension	Reasoning	Score
Conciseness	Lean body that assumes Claude's competence (no explanation of what SIEM/IOC means) with compact code snippets; the correlation summary template and use-cases are useful but slightly more verbose than strictly necessary.	4 / 5
Actionability	Provides concrete MCP call signatures (secops-mcp.get_security_alerts, secops-soar.list_cases) but uses placeholders like 'query=IOC_based_query' and 'IOC_based_filter' rather than executable query construction.	3 / 5
Workflow Clarity	Two clearly sequenced steps are present, but this batch operation over an IOC list has no validation checkpoints or error/empty-result handling; per the batch-operations cap, workflow clarity cannot exceed 3.	3 / 5
Progressive Disclosure	A self-contained, well-organized single file (Inputs, Workflow, Required Outputs, Use Cases, Template) with no external references needed; slightly above the under-50-line simple-skill threshold, so not a clean 5.	4 / 5
	Total	14 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that answers both what and when with concrete trigger phrases and a clear input/output contract. Minor room to add synonym terms and a couple more enumerated actions to push specificity and trigger coverage higher.

Dimension	Reasoning	Score
Specificity	Names the domain (SIEM alerts, case management, IOCs) and concrete actions ('Check for existing SIEM alerts and case management entries', 'Takes IOC list and returns related alerts and cases') with an explicit input/output contract, though coverage of actions is not exhaustive.	4 / 5
Completeness	Clearly states what it does (check for existing SIEM alerts and case entries related to IOCs) and an explicit 'Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations' trigger with concrete scenarios.	5 / 5
Trigger Term Quality	Includes natural analyst-facing terms ('SIEM alerts', 'case management', 'IOCs', 'indicator', 'investigations') that a user would say, but lacks common synonyms like 'threat hunt' or 'threat intelligence'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (SIEM/SOAR IOC correlation) with distinct triggers and an explicit input/output contract, minimizing overlap with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/correlate-ioc/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.