Secops Investigate
by google55b4e13eba6dNo license21K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today
Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triage), or basic case status updates (use secops-cases).
Only the file list is public. File contents are available once the skill is installed in a workspace.
| Path | Size | Type |
|---|---|---|
| SKILL.md | 18.2 KB | text/markdown |
Source and attribution
Source:google/skillsinskills/cloud/secops-investigateat commit55b4e13
License: No license
Content belongs to its original authors. SourceWeft indexes it from a public repository.
More from google/skills
Dpop Adoption
Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.
Finding Google Skills
Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.
Spanner Basics
Guides Google Cloud Spanner administration, schema design, querying and performance diagnosis.
Secops Triage
Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.
Secops Hunt
Guides proactive threat hunting in Google SecOps using UDM queries, IoC lookback, prevalence and outlier analysis.
Secops Cases
Manages Google Security Operations SOAR cases across their lifecycle via MCP tools.
More in Security
Iam Helper For Privileged Access Management
Guides Google Cloud Privileged Access Manager entitlement CRUD, temporary access requests, and grant approval workflows.
Iam Helper For Policy Management
Guides creation, modification, listing and deletion of Google Cloud IAM allow (v1) and deny (v2) policies.
Gke Workload Security
Audits and hardens GKE workload security: network policies, sandbox isolation, pod security standards and secret mounts.
Gke Workload Identity
Diagnoses GKE Workload Identity Federation authentication failures for Pods and proposes fixes for a human to apply.
Gke Productionize
Orchestrates GKE production readiness reviews across scalability, security, reliability, observability, backup and cost.
Gke Platform Security
Hardens platform-level Google Kubernetes Engine cluster security, covering RBAC, Secret Manager, Shielded Nodes, Sandbox and IAM.