Secops Triage
作者 google55b4e13eba6d无许可证21K 个星标收录于 2026年10月8日更新于 2026年10月8日仓库今天更新
Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity risk, adjusting alert severity or priority, and closing or escalating alerts and cases. Don't use for deep multi-hop incident investigations across host timelines (use secops-investigate), proactive threat hunting or retroactive IoC sweeps (use secops-hunt), or authoring new detection rules (use secops-detection-engineering).
- 55b4e13eba6d当前提交 55b4e13发布于 2026年10月8日
来源与署名
来源：google/skills位于skills/cloud/secops-triage提交55b4e13
许可证： 无许可证
内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。
更多来自 google/skills 的技能
Dpop Adoption
指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。
Finding Google Skills
Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.
Spanner Basics
指导 Google Cloud Spanner 的实例与数据库管理、架构设计、查询和性能诊断。
Secops Investigate
指导 SOC 分析师在 Google SecOps 中使用 UDM 查询和时间线进行深入的安全事件与实体调查。
Secops Hunt
指导在 Google SecOps 中使用 UDM 查询、IoC 回溯、普遍性与异常分析进行主动威胁狩猎。
Secops Cases
通过 MCP 工具管理 Google Security Operations SOAR 案例的整个生命周期。
更多Security技能
Iam Helper For Privileged Access Management
指导 Google Cloud Privileged Access Manager 的权限配置增删改查、临时访问申请与授权审批流程。
Iam Helper For Policy Management
指导创建、修改、列出和删除 Google Cloud IAM 允许（v1）与拒绝（v2）政策。
Gke Workload Security
审计并加固 GKE 工作负载安全：网络策略、沙箱隔离、Pod 安全标准与密钥挂载。
Gke Workload Identity
诊断 GKE Pod 的 Workload Identity Federation 身份验证失败，并提出由人工执行的修复方案。
Gke Productionize
统筹 GKE 生产就绪评估，涵盖可扩展性、安全、可靠性、可观测性、备份与成本。
Gke Platform Security
强化 Google Kubernetes Engine 集群的平台级安全，涵盖 RBAC、Secret Manager、Shielded Nodes、Sandbox 与 IAM。