Investigate Google Threat Intelligence Collection ID (Enhanced)

Objective: Investigate Google Threat Intelligence Collection ID provided by the user ${COLLECTION_ID}. Enrich findings with detailed entity reports and correlate with the local environment (SIEM/SOAR). Create a timestamped markdown report summarizing findings, correlations, and recommended actions.

Instructions:

1. Initial Collection Context:

   • Use the get_collection_report tool from the Google Threat Intelligence MCP server (gti-mcp).
   • Provide the argument: id: ${COLLECTION_ID}.
   • Record the collection details, especially the collection_type.

2. Define Relationships to Investigate:

   • Based on the collection_type (from Step 1), determine a prioritized list of relevant relationships. (Default: ["associations", "attack_techniques", "domains", "files", "ip_addresses", "urls", "threat_actors", "malware_families", "software_toolkits", "campaigns", "vulnerabilities", "reports", "suspected_threat_actors"], but can be narrowed). Let's call this RELATIONSHIP_LIST.

3. Iterative GTI Relationship Investigation:

   • Initialize an empty data structure (e.g., gti_findings) to store results.
   • Loop through each relationship_name in RELATIONSHIP_LIST.
   • Use the get_entities_related_to_a_collection tool (gti-mcp).
   • Arguments: id: ${COLLECTION_ID}, relationship_name: current relationship name.
   • Store the results in gti_findings under the corresponding relationship_name.

4. Detailed GTI Entity Enrichment:

   • Initialize an empty data structure (e.g., enriched_entities) to store detailed reports.
   • Iterate through key entity types found in gti_findings (e.g., domains, files, ip_addresses).
   • For each entity found:
     • If it's a domain, use get_domain_report (gti-mcp) with the domain name. Store the result.
     • If it's a file (hash), use get_file_report (gti-mcp) with the hash. Store the result.
     • If it's an IP address, use get_ip_address_report (gti-mcp) with the IP. Store the result.
     • (Add other relevant enrichment tools if needed, e.g., get_url_report).

5. Local Environment Correlation (SIEM/SOAR):

   • Initialize an empty data structure (e.g., local_findings) to store correlation results.
   • Iterate through key IOCs found (domains, files, IPs from gti_findings).
   • For each IOC:
     • Use lookup_entity (secops-mcp) with entity_value = IOC. Store summary.
     • Use search_security_events (secops-mcp) with text query related to the IOC (e.g., "Events involving IP 1.2.3.4"). Store key event findings.
   • (Optional: Check if related threat actors/campaigns match existing SOAR cases using list_cases (secops-soar) with appropriate filters).

6. Data Synthesis and Formatting:

   • Initialize an empty markdown string for the report content.
   • Add a main title and summary section mentioning the Collection ID.
   • Add "Key Findings & Recommendations" section: Summarize critical entities, highlight correlations between GTI and local findings, and list actionable next steps.
   • Iterate through gti_findings and enriched_entities:
     • Add sections for each relationship type investigated.
     • List entities found. For enriched entities, include key details from their detailed reports (Step 4). Note relationships with no findings.
   • Add a "Local Environment Correlation" section:
     • Summarize results from lookup_entity and search_security_events for each checked IOC. Highlight any matches or significant activity.

7. Report Creation:

   • Generate a timestamp string (${timestamp}, e.g., yyyymmdd_hhmm).
   • Construct report_name_var (e.g., enhanced_report_${COLLECTION_ID}_${timestamp}.md).
   • Let the complete formatted markdown string be report_contents_var.
   • Use the write_report tool.
   • Arguments: report_name=${report_name_var}, report_contents=${report_contents_var}.

ADK Graph-Based Workflow Diagram

graph TD
    START(["START"]) --> extract_gti_collection_payload_node["1. extract_gti_collection_payload_node<br/><i>(Extract GTI Collection ID Payload)</i>"]
    extract_gti_collection_payload_node --> fetch_gti_collection_report_node["2. fetch_gti_collection_report_node<br/><i>(Fetch GTI Collection Intel & SIEM Correlation)</i>"]
    fetch_gti_collection_report_node --> gti_collection_investigation_router{"3. gti_collection_investigation_router<br/><i>(Event.actions.route)</i>"}

    gti_collection_investigation_router -- "ACTIVE_CAMPAIGN_DETECTED" --> handle_active_campaign_branch["4a. handle_active_campaign_branch<br/><i>(Document Active Campaign Matches)</i>"]
    gti_collection_investigation_router -- "NO_SIEM_MATCH" --> handle_no_siem_match_branch["4b. handle_no_siem_match_branch<br/><i>(Document No SIEM Matches)</i>"]

    handle_active_campaign_branch --> document_gti_collection_report_node["5. document_gti_collection_report_node<br/><i>(SOAR Comment & Report Summary)</i>"]
    handle_no_siem_match_branch --> document_gti_collection_report_node

Sequence Diagram

sequenceDiagram
    participant User
    participant AutomatedAgent as Automated Agent (MCP Client)
    participant GTI as gti-mcp
    participant SIEM as secops-mcp
    participant SOAR as secops-soar

    User->>AutomatedAgent: Investigate GTI Collection ID `${COLLECTION_ID}` (Enhanced)

    %% Step 1: Initial Collection Context
    AutomatedAgent->>GTI: get_collection_report(id=`${COLLECTION_ID}`)
    GTI-->>AutomatedAgent: Collection Details (Type: T)

    %% Step 2 & 3: Define & Investigate Relationships
    Note over AutomatedAgent: Determine RELATIONSHIP_LIST based on Type T
    loop For each relationship_name in RELATIONSHIP_LIST
        AutomatedAgent->>GTI: get_entities_related_to_a_collection(id=`${COLLECTION_ID}`, relationship_name=...)
        GTI-->>AutomatedAgent: Related Entities (E1, E2...) for relationship
        Note over AutomatedAgent: Store entities in gti_findings
    end

    %% Step 4: Detailed GTI Entity Enrichment
    Note over AutomatedAgent: Initialize enriched_entities
    loop For each key Entity Ei in gti_findings (Files, Domains, IPs)
        alt Entity is File (Hash H)
            AutomatedAgent->>GTI: get_file_report(hash=H)
            GTI-->>AutomatedAgent: File Report for H
            Note over AutomatedAgent: Store in enriched_entities
        else Entity is Domain (D)
            AutomatedAgent->>GTI: get_domain_report(domain=D)
            GTI-->>AutomatedAgent: Domain Report for D
            Note over AutomatedAgent: Store in enriched_entities
        else Entity is IP Address (IP)
            AutomatedAgent->>GTI: get_ip_address_report(ip_address=IP)
            GTI-->>AutomatedAgent: IP Report for IP
            Note over AutomatedAgent: Store in enriched_entities
        end
    end

    %% Step 5: Local Environment Correlation
    Note over AutomatedAgent: Initialize local_findings
    loop For each key IOC Ii from gti_findings (Files, Domains, IPs)
        AutomatedAgent->>SIEM: lookup_entity(entity_value=Ii)
        SIEM-->>AutomatedAgent: SIEM Entity Summary for Ii
        Note over AutomatedAgent: Store in local_findings
        AutomatedAgent->>SIEM: search_security_events(text="Events involving Ii")
        SIEM-->>AutomatedAgent: Relevant SIEM Events for Ii
        Note over AutomatedAgent: Store in local_findings
    end
    %% Optional SOAR Check (Conceptual)
    %% AutomatedAgent->>SOAR: list_cases(filter="Related to Campaign/Actor from GTI")
    %% SOAR-->>AutomatedAgent: Potentially related SOAR cases

    %% Step 6 & 7: Synthesize Report and Write File
    Note over AutomatedAgent: Synthesize report content (report_contents_var) from gti_findings, enriched_entities, local_findings
    Note over AutomatedAgent: Include Key Findings & Recommendations
    Note over AutomatedAgent: Construct report_name_var (e.g., enhanced_report_${COLLECTION_ID}_${timestamp}.md)
    AutomatedAgent->>AutomatedAgent: write_report(report_name=report_name_var, report_contents=report_contents_var)
    Note over AutomatedAgent: Report file created

    AutomatedAgent->>User: attempt_completion(result="Enhanced investigation complete. Report generated.")

## Rubrics

The following rubric is used to evaluate the execution of this **Threat Hunt/Analysis** runbook by an LLM agent.

### Grading Scale (0-100 Points)

| Criteria | Points | Description |
| :--- | :--- | :--- |
| **Scope & Query** | 25 | Defined a clear scope and executed effective queries (UDM, search). |
| **Data Analysis** | 30 | Analyzed results to identify patterns, anomalies, or malicious behavior. |
| **Findings** | 15 | Accurately identified and filtered findings (True Positives vs. False Positives). |
| **Documentation** | 15 | Documented the hunt methodology and results clearly. |
| **Operational Artifacts** | 15 | Produced required artifacts: Sequence diagram, execution metadata (date/cost), and summary. |

### Evaluation Criteria Details

#### 1. Scope & Query (25 Points)
- **10 pts**: Correctly defined the time range and entities/indicators for the hunt.
- **15 pts**: Constructed and executed valid, efficient queries to retrieve relevant data.

#### 2. Data Analysis (30 Points)
- **15 pts**: Effectively analyzed the returned data for the hypothesized threat.
- **15 pts**: Correlated events or indicators to strengthen the analysis.

#### 3. Findings (15 Points)
- **15 pts**: Correctly classified the findings and provided evidence for the conclusion.

#### 4. Documentation (15 Points)
- **15 pts**: Recorded the hunt process, queries used, and findings in the system of record.

#### 5. Operational Artifacts (15 Points)
- **5 pts**: **Sequence Diagram**: Produced a Mermaid sequence diagram visualizing the steps taken.
- **5 pts**: **Execution Metadata**: Recorded the date, duration, and estimated token cost.
- **5 pts**: **Summary Report**: Generated a concise summary of the actions and outcomes.