Sample IOC Assessment

Use this sample when an alert contains a domain, URL, IP, hash, or email indicator. IOC investigations should preserve the original observable and use concrete expected types. Do not send ioc as an expected type.

Scenario

An analyst asks:

We saw login attempts from suspicious-domain.example. Is it known malicious, and should we block it?

MCP Session

A good agent prompt is explicit about the workflow and exact-string handling.

Use Kyberis to investigate suspicious-domain.example as a domain. Resolve it first, retrieve observed-in-the-wild and malware-association evidence, pivot relationships including related IOCs, then run an IOC assessment. Preserve request IDs, evidence IDs, confidence, and caveats.

Representative MCP tool sequence:

[
  {
    "tool": "entity_resolution",
    "arguments": {
      "query": "suspicious-domain.example",
      "expected_types": ["domain"],
      "resolution": { "max_results": 5, "include_metadata": true },
      "agent_context": {
        "workflow_stage": "resolve",
        "run_id": "run-ioc-domain-sample",
        "step_id": "resolve-domain"
      }
    }
  },
  {
    "tool": "evidence",
    "arguments": {
      "query": "suspicious-domain.example",
      "claim_type": "observed_in_the_wild",
      "max_results": 5,
      "agent_context": {
        "workflow_stage": "evidence",
        "run_id": "run-ioc-domain-sample",
        "step_id": "evidence-observed"
      }
    }
  },
  {
    "tool": "relationships",
    "arguments": {
      "subject": {
        "entity_type": "domain",
        "canonical_name": "suspicious-domain.example"
      },
      "relationship_types": ["campaign", "malware", "sector", "country", "ioc", "technique"],
      "max_results": 10,
      "agent_context": {
        "workflow_stage": "relationships",
        "run_id": "run-ioc-domain-sample",
        "step_id": "relationships-domain"
      }
    }
  },
  {
    "tool": "ioc_assessment",
    "arguments": {
      "query": "suspicious-domain.example",
      "agent_context": {
        "workflow_stage": "assessment",
        "run_id": "run-ioc-domain-sample",
        "step_id": "assessment-domain"
      }
    }
  }
]

Representative response excerpts:

{
  "resolution": { "status": "resolved", "confidence": "medium" },
  "entity_type": "domain",
  "canonical_name": "suspicious-domain.example",
  "request_id": "req_sample_ioc_resolve"
}

{
  "claim_type": "observed_in_the_wild",
  "items": [
    {
      "evidence_id": "report--sample-domain-observed",
      "confidence": "medium",
      "summary": "The domain appears in reporting about credential phishing infrastructure."
    }
  ],
  "request_id": "req_sample_ioc_evidence"
}

{
  "recommendation": "block",
  "confidence_score": 0.78,
  "disposition": "suspicious",
  "evidence_refs": ["report--sample-domain-observed"],
  "caveats": ["Confirm whether traffic was user-initiated or automated before broad containment."]
}

Contract Note

The relationships step is where related IOC expansion happens. The IOC assessment step assesses suspicious-domain.example itself and does not return event-correlated indicators inline.

REST Fallback

If MCP is not available, call the same workflow directly.

curl -sS -X POST "$KYBERIS_BASE_URL/v2/ioc-assessments" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Assess suspicious-domain.example with exact IOC fidelity.",
      "requested_outcome": "Return deterministic IOC risk guidance.",
      "workflow_stage": "assessment",
      "run_id": "run-ioc-domain-sample",
      "step_id": "assessment-domain"
    },
    "query": "suspicious-domain.example"
  }' | jq .

Final Answer Example

Recommendation: Block suspicious-domain.example at DNS and proxy controls, then hunt for recent access attempts. Why now: Kyberis found medium-confidence evidence that the domain appears in reporting about phishing infrastructure. The IOC assessment returned a suspicious disposition with a block recommendation. Confidence: Medium. The domain match is exact, but the sample evidence does not prove compromise in your environment. Supporting evidence: report--sample-domain-observed. Request IDs: req_sample_ioc_resolve, req_sample_ioc_evidence. Next actions: Block the domain, search authentication and proxy logs for the last 30 days, and review any successful logins from affected users.

Decision Gates

Preserve the original IOC string in the final answer.
Use exact query mode for URLs and observables when canonicalization could lose detail.
If subject-mode results are unexpectedly weak, retry once with exact query mode before finalizing.

Getting started

Install Kyberis

Threat investigations

Sample investigations

Interpret responses

Scenario

MCP Session

Contract Note

REST Fallback

Final Answer Example

Decision Gates

​Scenario

​MCP Session

​Contract Note

​REST Fallback

​Final Answer Example

​Decision Gates

Scenario

MCP Session

Contract Note

REST Fallback

Final Answer Example

Decision Gates