hunt_ioc_pack
Hunt behavioral indicators of compromise across exported logs, text artifacts, filenames, and PCAP payloads using a bundled IoC pack.
Instructions
Hunt behavioral IoCs from a metadata pack across exported logs, text artifacts, filenames, and PCAP payloads. Bundled pack: impacket-iocs.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| artifacts_dir | Yes | Base directory containing forensic artifacts, exported logs, PCAPs, or parsed tool output | |
| pack | No | Bundled pack id/name to load | impacket-iocs |
| pack_path | No | Optional external pack directory or pack.json path | |
| scan_files | No | Scan plaintext exports/logs and filenames | |
| scan_pcap | No | Scan PCAP payloads when scapy is installed | |
| max_files | No | Maximum files to inspect | |
| max_file_size | No | Skip files larger than this many bytes | |
| limit | No | Maximum findings/hits to return |