Secops Hunt
作者 google55b4e13eba6d无许可证21K 个星标收录于 2026年10月8日更新于 2026年10月8日仓库今天更新
Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of compromise (IoCs), performing prevalence searches across enterprise events, hunting for MITRE ATT&CK techniques, or detecting behavioral and statistical outliers using UDM queries. Don't use for incoming alert triage (use secops-triage), active incident response and timeline deep-dives on a known breach (use secops-investigate), or detection rule authoring (use secops-detection-engineering).
仅公开文件列表。将技能安装到工作区后即可查看文件内容。
| 路径 | 大小 | 类型 |
|---|---|---|
| SKILL.md | 10.9 KB | text/markdown |
更多来自 google/skills 的技能
Dpop Adoption
指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。
Finding Google Skills
Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.
Spanner Basics
指导 Google Cloud Spanner 的实例与数据库管理、架构设计、查询和性能诊断。
Secops Triage
指导 SOC 分析师对 Google SecOps 安全告警进行分诊，从调查到关闭或升级。
Secops Investigate
指导 SOC 分析师在 Google SecOps 中使用 UDM 查询和时间线进行深入的安全事件与实体调查。
Secops Cases
通过 MCP 工具管理 Google Security Operations SOAR 案例的整个生命周期。
更多Security技能
Iam Helper For Privileged Access Management
指导 Google Cloud Privileged Access Manager 的权限配置增删改查、临时访问申请与授权审批流程。
Iam Helper For Policy Management
指导创建、修改、列出和删除 Google Cloud IAM 允许（v1）与拒绝（v2）政策。
Gke Workload Security
审计并加固 GKE 工作负载安全：网络策略、沙箱隔离、Pod 安全标准与密钥挂载。
Gke Workload Identity
诊断 GKE Pod 的 Workload Identity Federation 身份验证失败，并提出由人工执行的修复方案。
Gke Productionize
统筹 GKE 生产就绪评估，涵盖可扩展性、安全、可靠性、可观测性、备份与成本。
Gke Platform Security
强化 Google Kubernetes Engine 集群的平台级安全，涵盖 RBAC、Secret Manager、Shielded Nodes、Sandbox 与 IAM。