Secops Investigate
作者 google55b4e13eba6d无许可证21K 个星标收录于 2026年10月8日更新于 2026年10月8日仓库今天更新
Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triage), or basic case status updates (use secops-cases).
仅公开文件列表。将技能安装到工作区后即可查看文件内容。
| 路径 | 大小 | 类型 |
|---|---|---|
| SKILL.md | 18.2 KB | text/markdown |
来源与署名
来源：google/skills位于skills/cloud/secops-investigate提交55b4e13
许可证： 无许可证
内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。
更多来自 google/skills 的技能
Dpop Adoption
指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。
Finding Google Skills
Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.
Spanner Basics
指导 Google Cloud Spanner 的实例与数据库管理、架构设计、查询和性能诊断。
Secops Triage
指导 SOC 分析师对 Google SecOps 安全告警进行分诊，从调查到关闭或升级。
Secops Hunt
指导在 Google SecOps 中使用 UDM 查询、IoC 回溯、普遍性与异常分析进行主动威胁狩猎。
Secops Cases
通过 MCP 工具管理 Google Security Operations SOAR 案例的整个生命周期。
更多Security技能
Iam Helper For Privileged Access Management
指导 Google Cloud Privileged Access Manager 的权限配置增删改查、临时访问申请与授权审批流程。
Iam Helper For Policy Management
指导创建、修改、列出和删除 Google Cloud IAM 允许（v1）与拒绝（v2）政策。
Gke Workload Security
审计并加固 GKE 工作负载安全：网络策略、沙箱隔离、Pod 安全标准与密钥挂载。
Gke Workload Identity
诊断 GKE Pod 的 Workload Identity Federation 身份验证失败，并提出由人工执行的修复方案。
Gke Productionize
统筹 GKE 生产就绪评估，涵盖可扩展性、安全、可靠性、可观测性、备份与成本。
Gke Platform Security
强化 Google Kubernetes Engine 集群的平台级安全，涵盖 RBAC、Secret Manager、Shielded Nodes、Sandbox 与 IAM。