IOC Retro Hunt Agent by Inspira

Agent Tasks

The IOC Retro Hunt Agent automatically investigates Indicators of Compromise (IOCs) across Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender Threat Intelligence (MDTI). It performs historical IOC hunting, threat intelligence enrichment, entity correlation, affected asset identification, MITRE ATT&CK mapping, blast radius analysis, and risk assessment to help security teams rapidly assess organizational exposure, understand the impact of malicious indicators, and prioritize response actions.

Agent Workflow

Input:

The agent accepts one or more of the following IOC types:

• IP Address

• Domain

• URL

• File Hash (MD5/SHA1/SHA256)

• Email Address

• Username

• Hostname

Output:

The agent generates a structured IOC investigation report containing:

• Executive Summary

• IOC Investigation Summary

• Historical IOC Sightings

• Threat Intelligence Enrichment

• Related Users, Devices, and Assets

• MITRE ATT&CK Mapping

• Blast Radius Assessment

• Risk Assessment

• Investigation Findings

• Recommended Actions