SecOps Threat Hunting
Guides an agent through proactive threat hunts, IoC lookbacks and anomaly searches in Google SecOps
- Repository
- google/skills
- Stars
- 21,782
- Licence
- Apache-2.0
- Files
- 2 files
What it does
This skill gives an AI agent expert playbooks for proactively searching a company's security telemetry in Google Security Operations (SecOps) for hidden threats. It teaches the agent to turn attacker techniques and threat-intel indicators (IP addresses, domains, file hashes, URLs) into UDM (Unified Data Model) queries, run them over bounded time windows, filter out benign noise, and summarize findings into case comments. It also covers prevalence searches for rare software or connections and detection of statistical outliers.
Great for
- Security analysts who run proactive threat hunts in Google SecOps
- Security teams checking whether newly published indicators of compromise appeared in their environment
- Engineers who want an agent to draft UDM queries for hunt hypotheses
Skip it if
- Triaging incoming alerts, which the skill says should use the separate secops-triage skill
- Active incident response or breach timeline work, which belongs to secops-investigate; using this skill for live breaches may miss urgent steps
- Writing detection rules, which the skill says belongs to secops-detection-engineering
Try asking
- “Hunt for LSASS credential dumping over the last 72 hours in our Windows fleet”
- “Check whether these IP addresses and domains from a threat bulletin appeared in our logs in the last 60 days”
- “Find rare binaries executed across our Linux workloads in the last 10 days”
- “Summarize the entity risk for this suspicious host and post findings to case 4512”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the Apache-2.0 licence and an attribution note.
secops-hunt.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip secops-hunt.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip secops-hunt.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Always state explicit start and end times and a result limit (for example 50-100 events) to avoid expensive unbounded scans.
- Review the agent's queries before running them against production telemetry, and confirm which tool set (remote MCP or local) is actually available.
- Treat hunt results as untrusted data; the skill includes a prompt-injection defense, but analysts should still verify findings before escalating.
What's inside
- references/attribution.md
- SKILL.md
Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.