dt-sec-ioc-hunting

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

IoC Hunting Skill

IoC 狩猎技能

Hunt indicators of compromise (IoCs) across Dynatrace logs and spans, and optionally correlate CVEs and attacker-IPs/MITRE techniques through

security.events

(routed to dt-sec-insights). Produces matched-observable evidence sets and an AI threat-exposure score (0–100%).

在Dynatrace 日志和追踪跨度（spans）中排查入侵指标（IoCs），并可通过
security.events
将CVE与攻击者IP/MITRE技术关联（路由至dt-sec-insights）。生成匹配的可观测证据集和AI威胁暴露评分（0–100%）。

Universal Best Practices

通用最佳实践

Always load
dt-dql-essentials
first — it provides DQL syntax, function reference, and query construction patterns required by all hunt templates.
Ground every query in a template — reference files contain validated DQL adapted from the Dynatrace Threat Exposure Analysis dashboard. Do not improvise hunt queries; modify only the IoC arrays and time window.
Use indexed log prefiltering for broad hunts — in log hunts, generate literal
```
matchesPhrase(content, "<ioc>")
```
clauses before using
```
contains
```
to populate matched-observable columns. Do not start unscoped log hunts with raw
```
iAny(contains(content, allObservables[]))
```
.
Chunk large log IoC sets — do not generate one DQL query with hundreds of
```
matchesPhrase
```
clauses. Split large IoC lists into smaller chunks (default 25 IoCs; 10 for long URLs/emails/hashes or after a query-length failure), run each chunk with the same timeframe/scope, and aggregate results outside DQL. A no-match conclusion is valid only if every chunk completes cleanly.
Tight windows for logs and spans — default
```
from:now()-15m
```
for unanchored hunts. Use event-anchored windows for IoCs derived from timestamped detections/logs/events. Widen only on approval (see
```
timeframe-gating.md
```
).
Never send CVE or MITRE TTPs to logs/spans — they have no matching field there. Route them to
```
dt-sec-insights
```
(
```
threat-intelligence.md
```
).
Emails and file hashes have no span home — logs only (
```
hunt-logs.md
```
).
Hostnames fold into Domains — there is no
```
threat.observables.hosts
```
field. Hostname IoCs belong in the Domains array.
Report empty results truthfully — "no matches in the searched window" is a real, useful answer; propose widening rather than fabricating evidence.
One-home-per-pattern —
```
security.events
```
legs (VULNERABILITY, DETECTION_FINDING, THREAT_REPORT) are exclusively owned by
```
dt-sec-insights
```
. Never re-author those queries here.
Unscoped hunts are valid for broad discovery — when the user has only IoCs and no entity context, run the hunt without a scope filter. Do not silently add a namespace, host, or service filter.
```
FETCH_EXEC_TIME_LIMIT
```
on an unscoped hunt is INCONCLUSIVE, not no-match. Offer scoped follow-up only if entity context exists or the user explicitly provides one.
After primary hunts, extract and re-hunt secondary observables — before scoring, inspect every matched log or span record for additional IPs in proxy/relay headers (
```
X-Forwarded-For
```
,
```
Forwarded
```
,
```
X-Real-IP
```
,
```
True-Client-IP
```
,
```
CF-Connecting-IP
```
,
```
Akamai-True-Client-IP
```
, etc.) and structured fields (
```
clientIP
```
,
```
src_ip
```
,
```
source.ip
```
,
```
remote_addr
```
). Deduplicate against already-hunted IPs and re-hunt derived IPs across logs, spans, and detection
```
actor.ips
```
using the same window and scope. Do this automatically — never wait for user prompting. See
```
secondary-observable-extraction.md
```
.

始终优先加载
dt-dql-essentials
——它提供所有排查模板所需的DQL语法、函数参考和查询构建模式。
所有查询均基于模板——参考文件包含经验证的DQL，改编自Dynatrace威胁暴露分析仪表板。请勿自行编写排查查询；仅修改IoC数组和时间窗口。
针对大范围排查使用索引日志预过滤——在日志排查中，先生成
```
matchesPhrase(content, "<ioc>")
```
字面量子句，再使用
```
contains
```
填充匹配的可观测列。不要以未限定范围的
```
iAny(contains(content, allObservables[]))
```
开始日志排查。
拆分大型日志IoC集合——不要生成包含数百个
```
matchesPhrase
```
子句的单个DQL查询。将大型IoC列表拆分为较小的块（默认25个IoC；对于长URL/邮箱/哈希或查询长度失败后为10个），在相同时间范围/范围内运行每个块，并在DQL之外聚合结果。只有当每个块都顺利完成时，“无匹配”的结论才有效。
为日志和跨度设置紧凑的时间窗口——未锚定排查的默认时间范围为
```
from:now()-15m
```
。对于从带时间戳的检测/日志/事件中提取的IoC，使用事件锚定窗口。仅在获得批准后才扩大范围（参见
```
timeframe-gating.md
```
）。
切勿将CVE或MITRE TTPs发送至日志/跨度——这些数据在日志/跨度中没有匹配字段。将它们路由至
```
dt-sec-insights
```
（
```
threat-intelligence.md
```
）。
邮箱和文件哈希仅存在于日志中——仅使用日志排查（
```
hunt-logs.md
```
）。
主机名归入域名——不存在
```
threat.observables.hosts
```
字段。主机名IoCs属于域名数组。
如实报告空结果——“在搜索窗口内无匹配”是真实且有用的答案；建议扩大范围而非编造证据。
每种模式对应唯一数据源——
```
security.events
```
相关流程（VULNERABILITY、DETECTION_FINDING、THREAT_REPORT）完全由
```
dt-sec-insights
```
负责。切勿在此处重新编写这些查询。
未限定范围的排查适用于广泛发现——当用户仅有IoCs而无实体上下文时，运行无范围过滤的排查。不要静默添加命名空间、主机或服务过滤器。未限定范围排查的
```
FETCH_EXEC_TIME_LIMIT
```
结果为“不确定”，而非“无匹配”。仅当存在实体上下文或用户明确提供时，才提供限定范围的后续排查。
初次排查后，提取并重新排查二级可观测指标——在评分前，检查每个匹配的日志或跨度记录，查找代理/中继头（
```
X-Forwarded-For
```
、
```
Forwarded
```
、
```
X-Real-IP
```
、
```
True-Client-IP
```
、
```
CF-Connecting-IP
```
、
```
Akamai-True-Client-IP
```
等）和结构化字段（
```
clientIP
```
、
```
src_ip
```
、
```
source.ip
```
、
```
remote_addr
```
）中的其他IP。与已排查的IP去重后，使用相同的时间窗口和范围在日志、跨度和检测
```
actor.ips
```
中重新排查衍生IP。自动执行此操作——切勿等待用户提示。参见
```
secondary-observable-extraction.md
```
。

IoC Type → Data Source → Reference

IoC类型 → 数据源 → 参考文档

IoC type	Logs	Spans (inbound + outbound)	security.events
IP	`hunt-logs.md`	`hunt-spans.md`	Detections → dt-sec-insights
Domain (incl. hostname)	`hunt-logs.md`	`hunt-spans.md`	—
URL	`hunt-logs.md`	`hunt-spans.md`	—
Email	`hunt-logs.md`	❌ no span field	—
File hash (md5/sha1/sha256)	`hunt-logs.md`	❌ no span field	—
CVE	—	—	Vulnerabilities → dt-sec-insights
MITRE TTP	—	—	Detections → dt-sec-insights

Pull IoCs FROM a THREAT_REPORT event — route to dt-sec-insights
threat-intelligence.md
§ Indicators of Compromise. THREAT_REPORT is a
security.events
dataset; this skill does not query it.

IoC类型	日志	跨度（入站+出站）	security.events
IP	`hunt-logs.md`	`hunt-spans.md`	检测 → dt-sec-insights
域名（含主机名）	`hunt-logs.md`	`hunt-spans.md`	—
URL	`hunt-logs.md`	`hunt-spans.md`	—
邮箱	`hunt-logs.md`	❌ 无跨度字段	—
文件哈希（md5/sha1/sha256）	`hunt-logs.md`	❌ 无跨度字段	—
CVE	—	—	漏洞 → dt-sec-insights
MITRE TTP	—	—	检测 → dt-sec-insights

从THREAT_REPORT事件中提取IoCs——路由至dt-sec-insights
threat-intelligence.md
§ 入侵指标。THREAT_REPORT是
security.events
数据集；本技能不查询该数据集。

When to Use This Skill

何时使用本技能

User says	Load this reference
Extract IoCs from an advisory URL / web page	`ioc-intake.md` (agent fetches the page; see intake note)
Extract IoCs from a pasted advisory / report / STIX text	`ioc-intake.md`
Hunt these IPs/domains/URLs/emails/hashes in logs	`hunt-logs.md`
Hunt these IPs/domains/URLs in spans/traces	`hunt-spans.md`
Score how exposed my environment is / threat exposure report	`exposure-scoring.md`
Cross-evidence correlation — do detection and CVE relate?	dt-sec-contextualization → `correlation-and-coverage.md`
Pod→node topology (detection on pod, CVE on node)	dt-sec-contextualization → `correlation-and-coverage.md` § Pod→Node Topology
Compliance enrichment on matched entities	dt-sec-insights → `compliance.md` § Entity Security-Tab View
A matched IoC — which threat reports mention it (actor/malware/campaign)?	dt-sec-contextualization → `ioc-enrichment.md`
Timeframe too short / should I widen the search window?	`timeframe-gating.md`
Secondary IPs in evidence (X-Forwarded-For, proxy headers, structured fields)	`secondary-observable-extraction.md`
CVEs from this report — am I vulnerable?	Route to dt-sec-insights
IPs from this report — any detections?	Route to dt-sec-insights
MITRE techniques from this report — any detections?	Route to dt-sec-insights

用户需求	加载该参考文档
从公告URL/网页提取IoCs	`ioc-intake.md` （Agent获取页面；参见提取说明）
从粘贴的公告/报告/STIX文本提取IoCs	`ioc-intake.md`
在日志中排查这些IP/域名/URL/邮箱/哈希	`hunt-logs.md`
在跨度/追踪中排查这些IP/域名/URL	`hunt-spans.md`
评估我的环境暴露程度/生成威胁暴露报告	`exposure-scoring.md`
跨证据关联——检测与CVE是否相关？	dt-sec-contextualization → `correlation-and-coverage.md`
Pod→节点拓扑（Pod上的检测，节点上的CVE）	dt-sec-contextualization → `correlation-and-coverage.md` § Pod→Node拓扑
匹配实体的合规增强	dt-sec-insights → `compliance.md` § 实体安全标签视图
匹配的IoC——哪些威胁报告提及它（攻击者/恶意软件/活动）？	dt-sec-contextualization → `ioc-enrichment.md`
时间范围太短/是否应该扩大搜索窗口？	`timeframe-gating.md`
证据中的二级IP（X-Forwarded-For、代理头、结构化字段）	`secondary-observable-extraction.md`
本报告中的CVE——我是否存在漏洞？	路由至dt-sec-insights
本报告中的IP——是否有检测结果？	路由至dt-sec-insights
本报告中的MITRE技术——是否有检测结果？	路由至dt-sec-insights

Skill	Role
`dt-dql-essentials`	Load first. Core DQL syntax, functions, query patterns.
`dt-sec-insights`	`security.events` — vulnerabilities, detections, THREAT_REPORT IoC extraction.
`dt-sec-contextualization`	Cross-evidence correlation, pod→node topology, per-entity enrichment, compliance enrichment on matched entities, and IoC→threat-report attribution ( `ioc-enrichment.md` ). Load after hunt legs complete.
`dt-obs-logs`	Generic log exploration not tied to IoC hunting.
`dt-obs-tracing`	Generic span/trace analysis not tied to IoC hunting; span field semantics.

技能	作用
`dt-dql-essentials`	优先加载。核心DQL语法、函数、查询模式。
`dt-sec-insights`	`security.events` ——漏洞、检测、THREAT_REPORT IoC提取。
`dt-sec-contextualization`	跨证据关联、Pod→节点拓扑、按实体增强、匹配实体的合规增强，以及IoC→威胁报告归因（ `ioc-enrichment.md` ）。在排查流程完成后加载。
`dt-obs-logs`	与IoC排查无关的通用日志探索。
`dt-obs-tracing`	与IoC排查无关的通用跨度/追踪分析；跨度字段语义。