ioc-pivot

# Vulnetix IOC Pivot Skill ## Use when - A CVE is actively exploited and you need a blocklist of attacker IPs/ASNs to feed your edge firewall. - Exporting to STIX 2.1 for Splunk / Sentinel / Cortex / Tines ingestion. - Building a geo-distribution view of attack origin for an executive brief. - Correlating CrowdSec community sightings with internal SIEM detections. - Mapping the ATT&CK technique chain associated with the exploit. ## Don't use for - Generating detection rules for the IDS — use `/vulnetix:detection-rules`. - Single-CVE enrichment without IOC focus — use `/vulnetix:vuln`. - Cross-CVE IOC search by country/ASN — use `vulnetix vdb iocs list` directly (this skill is per-CVE). ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Builds a SOC-grade IOC view for a single CVE — combines `vdb iocs` (CrowdSec sightings + Shadowserver counts) and `vdb sightings` (merged timeline) into a single report. Exports STIX bundle when the user has a SOAR sink. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Capture `derived.soar` to decide STIX export; capture `de...