Skip to content
Get packs

Google SecOps Investigation

Guides an agent through deep security incident and entity investigations in Google SecOps.

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
2 files

What it does

Once installed, the agent works like a Tier 2/3 security analyst inside Google Security Operations. It knows how to pivot on hosts, IPs, domains, hashes and users, write UDM (Unified Data Model) searches for process, network, login and file events, and build timelines of what an asset or user did. It also looks for lateral movement such as PsExec, WMI, SMB or WinRM use, and steers the user toward other skills for detection-rule writing, proactive hunting, alert triage or simple case updates.

Great for

  • SOC analysts and incident responders investigating an open case in Google SecOps
  • Teams that want consistent UDM query patterns and timeline reconstruction during an incident
  • Engineers learning how to structure a security investigation

Skip it if

  • Writing or tuning detection rules or YARA-L, which the description routes to secops-detection-engineering
  • Proactive threat hunting without a specific incident, which is routed to secops-hunt; or simple case status updates, routed to secops-cases
  • Anyone without a Google SecOps tenant, since the queries and tools only work against that platform

Try asking

  • “Investigate case 4812 and pull all PROCESS_LAUNCH events for the host in the two hours around the alert”
  • “Summarize the IP 203.0.113.45 and check whether it matches any known IoC”
  • “Build a timeline of user jdoe's logins and resource access over the last 24 hours”
  • “Check whether the suspicious SHA256 hash ran on any asset and what child processes it spawned”
Step-by-step guide: how to use Google SecOps InvestigationInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the Apache-2.0 licence and an attribution note.

    secops-investigate.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip secops-investigate.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip secops-investigate.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Give the agent a concrete anchor such as a case ID, hash, IP or username so it can bound the time window
  • Keep the agent in read-only investigation mode and review any create_case_comment or update_case actions before they run
  • Confirm the time window and result limits (50-100 events first) so queries stay focused and cheap

What's inside

  • references/attribution.md
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.