Open the working folder
Put copies of your logs and an empty iocs.txt into the chat's working folder. Never point the agent at the originals.
Workflows
Indicators of compromise tools: a step-by-step IOC search
03
Check your logs against a new IOC report
A new report lists addresses, domains and hashes, and you want to know whether any appear in your own logs. When finding IOCs, prefer reliable sources such as published advisories, incident reports and your own past incidents, and check the date of each entry, since old ones go stale. Copy the logs first. Then let the agent turn the report into a list, search the copies and write down every lead for review.
Fill iocs.txt
Ask the agent to read the report and write the indicators into iocs.txt, restoring defanged text. Check the diff.
Search the log copies
Use Plan only to list the searches without running them; Ask first pauses before any action that changes something.
Check and note results
Read each match in context with read_file, then have the agent write a findings note listing indicator, file and line.
An example iocs.txt
Search the log copies for every indicator in iocs.txt and list each match with its file and line.
- read_file
iocs.txtlist read - glob
logs-copy/*.loglogs found - grep
192.0.2.44 in logs-copy2 matches - read_file
logs-copy/dns.logcontext read
Waiting for your OK before the next stepRejectAccept
iocs.txt
# iocs.txt - test indicators for incident 001
# one indicator per line: <type> <value>
ip 192.0.2.44
ip 198.51.100.17
domain update-check.example.test
domain files.example.org
url hxxps://files.example.org/get/invoice
md5 d41d8cd98f00b204e9800998ecf8427e
file C:\Users\Public\Test-invoice.txt
reg HKCU\Software\TestRunKey
task TestSyncTaskA plain-text list: comment lines start with a hash sign, every other line is a type and a value. All values are harmless documentation examples, and the hxxps address is defanged.
Hash files and keep an indicators of compromise database
Hash a file without opening it
Two of the indicators of compromise tools you need are already part of Windows: certutil and findstr. Copy the suspicious file into the working folder, and let Shell run certutil -hashfile on the copy. Shell can also run the command line forensics tools you already use, and it reports the real exit code of each command. Then grep searches iocs.txt for the printed value, and findstr can do the same in a text export. A match is a lead, never a verdict. Use Plan only to read the command before it runs, and never open or run the file itself.
Keep one file per incident
A small indicators of compromise database can be one plain text or CSV file per incident in a folder your team shares. Advisories often add context about an IOC: where it was seen in the wild and which methods the attacker used with it. Ask the agent to keep that context as a comment line above its value. Use edit_file to tidy the file and read the diff. Plain files are easy to review. Next time, search the whole folder with grep and compare the hits with your earlier notes before you decide what to report. The findings note can list hits in time order, and you check that order against the log.
