Guide analysts through SIEM searches, IOC gathering, and phased investigations.
npx skills add https://github.com/google/mcp-security --skill secops-hunt
Please help me install this Agent Skill. Skill: secops-hunt Source: https://github.com/google/mcp-security/tree/main/extensions/google-secops/skills/hunt Command: npx skills add https://github.com/google/mcp-security --skill secops-hunt
This Skill provides expert guidance for proactive threat hunting, helping security teams identify undetected threats, align workflows, and accelerate investigations.
Start a proactive hunt by asking for IOCs related to a GTI Campaign or Threat Actor and walk through the Phase 1 IOC search, Phase 2 deep investigation, and result synthesis.
High-intent search queries and answers about installing and using this skill.
Start proactive threat hunting by providing IOCs linked to a GTI Campaign or Threat Actor, then follow the guided Phase 1 IOC searches and Phase 2 deep investigations to synthesize findings and create cases.
Structure SIEM searches for threat investigations by following a phased workflow that begins with IOC gathering and correlation in Phase 1, advancing to deep event lookups and hypothesis validation in Phase 2.
Yes, you can use GTI campaign data to guide SOC case management by driving iterative lookups across events and IOCs, culminating in structured case creation or concise hunter reporting for stakeholders.
The threat hunting workflow supports iterative IOC lookups across events and cases within a SOC environment, allowing analysts to progressively refine hypotheses during phased investigations.
Generate hunter reports after a deep investigation by completing the phased IOC searches and event correlations, which structures the synthesized findings into concise reporting for stakeholders.
dandyeAggregate GTI reports, SIEM findings, and related entities for a single IOC.
vikingokftShare a Google Docs document with editors and email collaborators the link.
zenobi-usCoordinate incident response for security breaches and operational incidents.
ConsiliencyDetect project technology stacks by analyzing package manifests and configuration files.
