Reads your files
read_file, grep and glob open and search the log copies and iocs.txt in the chat's working folder.
Product
Indicators of compromise examples the agent can search for
01
Indicators of compromise examples are easy to picture: a file hash from a report, an IP address in a firewall log, a domain in a DNS log, or a scheduled task you never created. Each one is a trace you search for in your logs. GoChannel Desk looks for them in copies of your own files and shows every result as a card.
Runs your commands
Shell runs commands such as certutil and findstr and reports the real exit code; dangerous commands are blocked.
Asks before changing
Ask first pauses before any action that changes something, and Plan only lists the steps and changes nothing.
What the agent does for IOC work
- Filesread_file reads logs, write_file creates iocs.txt, edit_file changes it with a diff, and grep and glob find matches inside the working folder.
- Shellruns your own commands, such as certutil -hashfile to hash a file or findstr to search text, and reports the real exit code.
- Webweb_search and http_get read published advisories and incident reports, so you can copy the indicators into your own list.
- Screenshots and imagesocr reads text from a screenshot, for example an indicator table that was only published as a picture.
- Orchestrationtask runs parallel sub-agents on separate log folders, skill keeps a reusable playbook, and run_on_model sends a hard step to a bigger model.
- Approval modesAuto-run acts at once, Ask first pauses before every change, and Plan only lists the searches without running anything.
- Cronruns a prompt on a schedule, for example a weekly search of a fresh log export you have copied into the folder.
- Modelsconnect a cloud AI provider, a model on your own PC or the built-in model, and press Test to check the endpoint.
Plain text is a good start for a list
Your indicators of compromise list can be a plain text file per incident, kept in a folder. Plain text is enough. The agent edits it with diffs, and prompts go only to the model endpoint you pick.
Read incident-note.txt and the table in table-screenshot.png, write the addresses, domains and hashes to iocs.txt, tidy the file and check each value against the note.
- read_file
incident-note.txtnote read - ocr
table-screenshot.pngtext read - write_file
iocs.txtsaved - edit_file
iocs.txtdiff shown - grep
192.0.2.44 in incident-note.txt1 match
Waiting for your OK before the next stepRejectAccept
Two worked examples
From messy notes to a clean list
Free-form notes are common after an incident, so the agent can act as a rough IOC parser: read_file opens the note, grep finds anything that looks like an address, hash or domain, and write_file saves a first iocs.txt. This is a draft. After a device shows unusual behavior, the indicators collected from its logs can go into the same list. Values such as a task name from Security event 4698 or a file name in a temp folder need a human eye, so ask the agent to add a comment line saying where each value came from. Run it in Ask first, read the diff line by line, and remove anything that is only a normal name in your environment.
Check a list, then share it
Run grep over your log copies for each line in iocs.txt and let write_file save a findings note beside it. If your team is sharing IOCs for enrichment and hunting, pass on only the reviewed, defanged list, never the raw logs. GoChannel Desk is not a case-management system: it writes a findings note into your folder, and your real case record stays wherever your team keeps it. Test the routine first on harmless documentation values, such as the 192.0.2.x range, and read every card as it appears before you trust it with a real incident.
What GoChannel Desk does not do
GoChannel Desk is a Windows app, not a hosted service or a plugin. Use it only on your own files, your PC and servers you are authorised to examine, and never on systems, accounts or data you do not own. Results can be wrong. Review every result before you rely on it.
