Indicator Pivoting.
/indicator-pivoting
Indicator pivoting is how a single known IOC becomes a map of an adversary's wider infrastructure. This free, MIT-licensed skill runs inside your AI coding agent (Claude Code, Cursor, Codex or Windsurf) and gives you a decision tree by indicator type, concrete next lookups for each pivot, a worked multi-hop example and pivot-quality scoring so you can tell a strong lead from a coincidence.
What it does.
Starting from one seed indicator, an IP, domain, hash or certificate, the skill points you to the pivots that make sense for that type and walks you across the IOC graph hop by hop. It suggests the right lookup at each step, tracks the relationships you uncover, and scores each pivot for quality so weak or shared infrastructure does not get treated as a confident link.
When to use it.
Reach for it when you have one indicator and need to know what else is connected, when you suspect a single alert is part of a larger campaign, or when you are mapping an actor's infrastructure ahead of detection work. It is the natural next step after an investigation skill returns a confirmed-bad indicator worth expanding.
What you get back.
A documented pivot chain: the seed indicator, each hop with the lookup that produced it, the related infrastructure discovered, and a quality score per pivot. The output makes the reasoning explicit, so a reviewer can see exactly why two indicators are believed to be connected rather than taking the link on trust.
How it fits your workflow.
Run it from your AI coding agent and let it route to the lookup skills in the same pack, then carry the cluster it builds into a campaign record or a threat actor profile. Because every pivot is scored and sourced, the resulting infrastructure map drops cleanly into enrichment and IOC export workflows without losing its provenance.
Frequently Asked Questions.
Ready to do more with less?
Request a demo or start your free trial today. Get instant access to AI-powered threat intelligence tailored to your organisation.