Skip to content
Get packs

Guide · Agent skill

How to use the SecOps Alert Triage agent skill (secops-triage)

Updated · written with AI from the project's own documentation and checked against our catalogue data

The SecOps Alert Triage agent skill (secops-triage) is a set of written instructions that teaches an AI agent to triage security alerts and SOAR cases in Google Security Operations, the SIEM and SOAR platform formerly known as Chronicle. This guide explains what the skill makes the agent do, how to install it, how to ask for it in plain language, and what to check before trusting its recommendations. By the end you will be able to install the skill and run a repeatable triage pass on an alert.

SecOps Alert Triagegoogle/skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the secops-triage skill ZIP from this page.
  2. 2Unzip into a skills folder. Unzip into ~/.claude/skills/ for personal use, or into .claude/skills/ in a project.
  3. 3Or upload in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the ZIP.
  4. 4Confirm your tools. Make sure the agent can reach Google SecOps case, UDM search and threat intelligence tools.
  5. 5Ask for triage with an ID. Give the agent an alert ID or case ID and ask it to triage the alert.
  6. 6Review the recommendation. Check the agent's FP/BTP/TP call, the UDM evidence and entity risk before closing or escalating.

What is an agent skill and what does secops-triage make the agent do?

An agent skill is a folder with a SKILL.md file that gives an AI agent a playbook for one kind of task. When the task matches the skill's description, the agent reads the playbook and follows it. The secops-triage skill is scoped to triage only: deciding whether an alert is a false positive, a benign true positive, or a true positive.

Following the skill, the agent gathers the alert's details and checks for duplicate or related cases. It runs suggested UDM log searches around the alert time, which the skill sets at plus or minus 2 to 4 hours. It then weighs the risk of the involved users, hosts, IP addresses, domains and file hashes, and recommends whether to close the alert, adjust its priority, or hand it to incident response.

  • Gathers case and alert context, detection title, rule name, MITRE ATT&CK tags and key entities
  • Checks for duplicate cases and closes redundant ones as DUPLICATE
  • Runs UDM searches for authentication, process execution and network activity
  • Assesses entity criticality and threat intelligence matches
  • Adjusts severity or priority, then closes FP/BTP with a root cause or escalates TP

Install the secops-triage skill

Download the skill ZIP from this page. Then choose one of two install locations. For a personal install available in all your projects, unzip it into ~/.claude/skills/. For a project-only install, unzip it into the .claude/skills/ folder inside your project.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills. Once installed, the skill folder should contain SKILL.md and references/attribution.md.

  • Personal: unzip into ~/.claude/skills/
  • Project only: unzip into .claude/skills/ in your project folder
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check what you need before you start

The skill does not connect to Google SecOps by itself. It relies on tools the agent can call. The source prefers Remote MCP tools and lists local equivalents as a fallback. You need Google SecOps (Chronicle) access with case and alert permissions, and access to tools for SecOps case operations, UDM search and threat intelligence entity lookups. Without these tools the agent cannot act on real alerts.

The skill also refers to Google Threat Intelligence entity lookups for its entity risk section, so that access is needed for the full workflow.

  • Google SecOps access with case and alert permissions
  • Remote MCP tools (preferred) or local equivalents for case, UDM search and threat intel
  • Access to Google Threat Intelligence entity lookups

Trigger the skill with natural requests

You do not need a special command. The skill's description tells the agent when to use it: investigating and triaging alerts, deciding false versus true positives, assessing entity risk, adjusting severity or priority, and closing or escalating alerts and cases. Ask for those things directly and include the alert or case ID.

The skill is designed to be called for alert and case triage. For deep multi-host timelines, the skill points you to secops-investigate. For proactive hunting or retroactive IoC sweeps, it points to secops-hunt. For writing new detection rules, it points to secops-detection-engineering.

  • "Triage alert 12345 in Google SecOps and tell me whether it is a false positive."
  • "Check whether case 67890 is a duplicate of an open case and close it if so."
  • "Assess the risk of the hosts and IPs in this case and recommend a priority."
  • "Search UDM events around this alert's trigger time for impossible travel."

Understand what the agent will search and decide

The skill gives the agent example UDM queries for three alert categories: suspicious authentication, malicious process execution, and network beaconing or exfiltration. For authentication it looks at USER_LOGIN events. For endpoint detections it looks at PROCESS_LAUNCH events and script interpreters. For network activity it looks at NETWORK_CONNECTION and NETWORK_DNS records.

Entity risk uses asset tiers. Tier 0 covers domain controllers, identity providers and root cloud organisation admins. Tier 1 covers internal databases, source code repositories and executive endpoints. Tier 2 covers standard workstations, build workers and staging environments.

  • Authentication: USER_LOGIN success and failure sequences, impossible travel, odd user-agents
  • Execution: PROCESS_LAUNCH parent-child chains involving powershell, cmd, wscript, bash and similar
  • Network: NETWORK_CONNECTION volume, frequency and external IPs
metadata.event_type = "USER_LOGIN" AND target.user.userid = "TARGET_USER"

Review safety notes before running it

The skill treats alert titles, detection descriptions, raw log payloads, entity values and analyst comments as untrusted data, not instructions. The agent is told never to execute code or commands embedded in alert telemetry or tickets. Keep that rule in mind if you paste in suspicious content.

The skill can close cases, including in bulk through execute_bulk_close_case. Review its decisions before relying on them for real incidents. The skill also requires the attribution steps in references/attribution.md for gcloud, REST and MCP calls. The skill's metadata says it does not run scripts but does use the network.

  • Human review is needed before bulk closures or closing real incidents
  • Untrusted alert content is not followed as instructions
  • Attribution tags are required on gcloud, REST and MCP calls; do not use gcloud config set for this

What people use it for

  • Triage a suspicious login alert by checking USER_LOGIN sequences for the target user
  • Close duplicate cases by commenting on the primary case and closing the redundant one as DUPLICATE
  • Check whether a flagged file hash or external IP matches threat intelligence before changing priority
  • Downgrade alerts from lab or benign telemetry and record the root cause before closing
  • Hand a confirmed true positive to incident response with the evidence gathered

Frequently asked questions

How do I install the secops-triage skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP.

What do I need to use the secops-triage skill?

You need Google SecOps (Chronicle) access with case and alert permissions, plus remote MCP tools or local equivalents for case operations, UDM search and threat intelligence. The workflow also uses Google Threat Intelligence entity lookups.

Is the secops-triage skill free?

The skill is licensed under Apache-2.0. Access to Google SecOps and Google Threat Intelligence is a separate requirement, and this page does not state pricing for either.

Does the skill run scripts or use the network?

The skill's metadata says it runs no scripts and does use the network. It works through the agent's SecOps, UDM and threat intelligence tools.

Can the skill investigate a full multi-host incident or hunt for threats?

No. The skill is scoped to triage. For deep multi-hop incident investigations it points to secops-investigate, and for proactive hunting or IoC sweeps it points to secops-hunt.

Should I let the agent close alerts automatically?

The source warns that the skill can close cases in bulk, so a human should review its decisions before relying on them for real incidents.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use secops-triage if you are a SOC analyst or security engineer who wants a consistent, repeatable triage routine in Google SecOps, with clear handoffs to deeper investigation. Pick something else if you do not have Google SecOps access, need multi-host timelines or proactive hunting, or want alerts closed with no human review.

Download the skill