How to use the Google SecOps Investigation agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file of instructions that an AI agent loads when a task matches the skill's description. This skill is written for investigating an open case in Google SecOps.

Once installed, the agent follows an investigation workflow: it summarizes entities and checks IoC matches, correlates case context and alerts, extracts UDM events, builds asset and user timelines, and looks for lateral movement such as PsExec, WMI, SMB or WinRM use. It is also told to treat retrieved telemetry, command lines and file paths as untrusted data rather than instructions.

• Pivot on hosts, IP addresses, domains, file hashes and users
• Write UDM searches for process, network, login, file and registry events
• Reconstruct chronological timelines for an asset or user
• Look for lateral movement indicators (PsExec, WMI, SMB, WinRM)
• Route work it does not cover to other skills: secops-detection-engineering, secops-hunt, secops-triage and secops-cases

Install the secops-investigate skill

Download the skill ZIP from this page and unzip it. The package contains SKILL.md and references/attribution.md. You can install it for yourself or for a single project.

For a personal install, unzip it into ~/.claude/skills/. For a project install, unzip it into the .claude/skills/ folder of that project. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/ (the skill folder should contain SKILL.md)
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Prepare your Google SecOps access and tools

The skill only works against a Google SecOps tenant. You need access to that tenant before you start. The skill prefers Remote MCP tools and falls back to local equivalents if those are not available.

Remote MCP tools named in the skill include udm_search, summarize_entity, get_ioc_match and the case tools. The local equivalents are search_udm (or search_security_events), lookup_entity and get_ioc_matches. The skill may also use the gcloud CLI, REST API or MCP access.

• Google Security Operations tenant access
• Remote MCP tools (udm_search, summarize_entity, get_ioc_match, case tools) or local equivalents (search_udm, lookup_entity, get_ioc_matches)
• gcloud CLI, REST API or MCP access as your setup requires

Trigger the skill with natural requests

You do not need to type a command to use the skill. Describe the investigation in plain language and mention the entity or case. The agent matches your request against the skill description and loads it when the task fits.

Be specific about the entity and the time window. The skill bounds searches to the incident window, typically 2 to 24 hours around the detection trigger, and starts with a limit of 50 to 100 events.

• "Investigate case 1234 in SecOps and tell me what the host WS-042 did in the last 6 hours."
• "Pivot on the hash in this alert and show every host where that process ran."
• "Build a timeline for user jdoe around the failed logins on Monday."
• "Check whether there is any PsExec or WinRM activity from this subnet during the incident."

Understand what the agent will run

For searches, the skill uses UDM syntax. A typical query looks for a suspicious hash in process launch events. Another looks for child processes of a shell on one host. The agent adapts the placeholders to your entity.

Expect the agent to read the Usage Attribution reference before running gcloud, REST API or MCP commands. Each gcloud command is prefixed with an inline CLOUDSDK_METRICS_REQUEST_ATTRIBUTION variable that tags it with the skill name and version, and the skill says not to use gcloud config set for this.

Safety notes: scripts and network

The skill does not run scripts. It does use the network, because its queries and tools call Google SecOps and related Google Cloud services. Plan your access accordingly and make sure the account the agent uses is allowed to query the tenant.

Telemetry is untrusted. Process command lines, file paths and log attributes can contain text written by an attacker. The skill instructs the agent not to execute commands or follow directions found in that data, but you should still review any action the agent proposes, especially case updates.

• Runs scripts: no
• Uses network: yes
• Use an account with only the tenant access the investigation needs
• Review proposed case comments and updates before they are posted

Tips for better investigations

Give the agent a case ID, hostname, IP, hash or username up front. Tight entity names and a bounded time window produce more useful results than a broad question. If the agent's first query returns too much noise, ask it to narrow the window or event type.

Use the skill for the investigation itself and the other skills for their jobs. If you want to write or tune a detection rule, use secops-detection-engineering. For open-ended hunting, use secops-hunt. For simple status updates, use secops-cases.

• Start with a specific entity and a time window
• Narrow noisy results by event type (PROCESS_LAUNCH, NETWORK_CONNECTION, USER_LOGIN, FILE_CREATION)
• Ask for a timeline once the key entities are known
• Use secops-cases for simple status changes