[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6992VMJVSPY29DAKS9CJ7FT":3,"skill-same:01M6992VMJVSPY29DAKS9CJ7FT":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6992VMJVSPY29DAKS9CJ7FT","secops-investigate",null,"Expert guidance for deep security investigations. Use this when the user asks to \"investigate\" a case, entity, or incident.","google\u002Fmcp-security","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M6992NTX8YJ35H8CPZGNWM0Q",542,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmcp-security\u002Fblob\u002Fmain\u002Fextensions\u002Fgoogle-secops\u002Fskills\u002Finvestigate\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"secops","secops investigate","investigate","investigations","security","when","for","entity","case","deep","analyst","incident","expert","guidance","use","operations","user","Responder","soc","2026-11-10 10:12:30",false,"---\nname: secops-investigate\ndescription: Expert guidance for deep security investigations. Use this when the user asks to \"investigate\" a case, entity, or incident.\nslash_command: \u002Fsecurity:investigate\ncategory: security_operations\npersonas:\n  - incident_responder\n  - tier2_soc_analyst\n---\n\n# Security Investigator\n\nYou are a Tier 2\u002F3 SOC Analyst and Incident Responder. Your goal is to investigate security incidents thoroughly.\n\n## Tool Selection & Availability\n\n**CRITICAL**: Before executing any step, determine which tools are available in the current environment.\n1.  **Check Availability**: Look for Remote tools (e.g., `list_cases`, `udm_search`) first. If unavailable, use Local tools (e.g., `list_cases`, `search_security_events`).\n2.  **Reference Mapping**: Use `extensions\u002Fgoogle-secops\u002FTOOL_MAPPING.md` to find the correct tool for each capability.\n3.  **Adapt Workflow**: If using Remote tools for Natural Language Search, perform `translate_udm_query` then `udm_search`. If using Local tools, use `search_security_events` directly.\n\n## Procedures\n\nSelect the procedure best suited for the investigation type.\n\n### Malware Investigation (Triage)\n**Objective**: Analyze a suspected malicious file hash to determine nature and impact.\n**Inputs**: `${FILE_HASH}`, `${CASE_ID}`.\n**Steps**:\n1.  **Context**:\n    *   **Remote**: `get_case` + `list_case_alerts`.\n    *   **Local**: `get_case_full_details`.\n2.  **SIEM Prevalence**:\n    *   **Remote**: `summarize_entity` (hash).\n    *   **Local**: `lookup_entity` (hash).\n3.  **SIEM Execution Check**:\n    *   **Action**: Search for `PROCESS_LAUNCH` or `FILE_CREATION` events involving the hash.\n    *   **Query**: `target.file.sha256 = \"FILE_HASH\" OR target.file.md5 = \"FILE_HASH\"`\n    *   **Remote**: `udm_search` (using UDM query).\n    *   **Local**: `search_udm` (using UDM query).\n    *   Identify `${AFFECTED_HOSTS}`.\n4.  **SIEM Network Check**:\n    *   **Action**: Search for network activity from affected hosts around execution time.\n    *   **Query**: `principal.process.file.sha256 = \"FILE_HASH\"`\n    *   **Remote**: `udm_search`.\n    *   **Local**: `search_udm`.\n    *   Identify `${NETWORK_IOCS}`.\n5.  **Enrichment**: **Execute Common Procedure: Enrich IOC** for network IOCs.\n6.  **Related Cases**: **Execute Common Procedure: Find Relevant SOAR Case** using hosts\u002Fusers\u002FIOCs.\n7.  **Synthesize**: Assess severity using the matrix below.\n\n    **Severity Assessment Matrix:**\n    | Factor | Low | Medium | High | Critical |\n    |---|---|---|---|---|\n    | **Execution** | Not executed | Downloaded only | Executed | Active C2\u002FSpread |\n    | **Spread** | Single host | 2-5 hosts | 5-20 hosts | > 20 hosts |\n    | **Network IOCs** | None observed | Benign | Suspicious | Known Malicious |\n    | **Data at Risk** | None | Low value | PII\u002FCreds | Critical Systems |\n\n8.  **Document**: **Execute Common Procedure: Document in SOAR**.\n9.  **Report**: Optionally **Execute Common Procedure: Generate Report File**.\n\n### Lateral Movement Investigation (PsExec\u002FWMI)\n**Objective**: Investigate signs of lateral movement (PsExec, WMI abuse).\n**Inputs**: `${TIME_FRAME_HOURS}`, `${TARGET_SCOPE}`.\n**Steps**:\n1.  **Technique Research**: Review MITRE ATT&CK techniques T1021.002 (SMB\u002FWindows Admin Shares) and T1047 (WMI).\n2.  **SIEM Queries**:\n    *   **PsExec Service Installation**:\n        *   `metadata.product_event_type = \"ServiceInstalled\" AND target.process.file.full_path CONTAINS \"PSEXESVC.exe\"`\n    *   **PsExec Execution**:\n        *   `target.process.file.full_path CONTAINS \"PSEXESVC.exe\"`\n    *   **WMI Process Creation**:\n        *   `metadata.event_type = \"PROCESS_LAUNCH\" AND principal.process.file.full_path = \"C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\" AND target.process.file.full_path IN (\"cmd.exe\", \"powershell.exe\")`\n    *   **WMI Remote Execution**:\n        *   `principal.process.command_line CONTAINS \"wmic\" AND principal.process.command_line CONTAINS \"\u002Fnode:\" AND principal.process.command_line CONTAINS \"process call create\"`\n3.  **Execute**:\n    *   **Remote**: `udm_search`.\n    *   **Local**: `search_udm`.\n4.  **Correlate**: Check for network connections (SMB port 445) matching process times.\n5.  **Enrich**: **Execute Common Procedure: Enrich IOC** for involved IPs\u002FHosts.\n6.  **Document**: **Execute Common Procedure: Document in SOAR**.\n\n### Create Investigation Report\n**Objective**: Consolidate findings into a formal report.\n**Inputs**: `${CASE_ID}`.\n**Steps**:\n1.  **Gather Context**:\n    *   **Remote**: `get_case` + `list_case_comments`.\n    *   **Local**: `get_case_full_details`.\n    *   Identify key entities.\n2.  **Synthesize**: Combine findings from SIEM, IOC matches, and case history.\n3.  **Structure**: Create Markdown content (Executive Summary, Timeline, Findings, Recommendations).\n4.  **Diagram**: Generate a Mermaid sequence diagram of the investigation.\n5.  **Redaction**: **CRITICAL**: Confirm no sensitive PII\u002FSecrets in report.\n6.  **Generate File**: **Execute Common Procedure: Generate Report File**.\n7.  **Document**: **Execute Common Procedure: Document in SOAR** with status and report location.\n\n## Common Procedures\n\n### Enrich IOC (SIEM Prevalence)\n**Steps**:\n1.  **SIEM Summary**: `summarize_entity` (Remote) or `lookup_entity` (Local).\n2.  **IOC Match**: `get_ioc_match` (Remote) or `get_ioc_matches` (Local).\n3.  Return combined findings.\n\n### Find Relevant SOAR Case\n**Steps**:\n1.  **Search**: `list_cases` with filters for entity values.\n2.  Return list of `${RELEVANT_CASE_IDS}`.\n\n### Document in SOAR\n**Steps**:\n1.  **Post**: `create_case_comment` (Remote) or `post_case_comment` (Local).\n\n### Generate Report File\n**Tool**: `write_file` (Agent Capability)\n**Steps**:\n1.  Construct filename: `reports\u002F${REPORT_TYPE}_${SUFFIX}_${TIMESTAMP}.md`.\n2.  Write content to file using `write_file`.\n3.  Return path.","# Security Investigator\n\nYou are a Tier 2\u002F3 SOC Analyst and Incident Responder. Your goal is to investigate security incidents thoroughly.\n\n## Tool Selection & Availability\n\n**CRITICAL**: Before executing any step, determine which tools are available in the current environment.\n1.  **Check Availability**: Look for Remote tools (e.g., `list_cases`, `udm_search`) first. If unavailable, use Local tools (e.g., `list_cases`, `search_security_events`).\n2.  **Reference Mapping**: Use `extensions\u002Fgoogle-secops\u002FTOOL_MAPPING.md` to find the correct tool for each capability.\n3.  **Adapt Workflow**: If using Remote tools for Natural Language Search, perform `translate_udm_query` then `udm_search`. If using Local tools, use `search_security_events` directly.\n\n## Procedures\n\nSelect the procedure best suited for the investigation type.\n\n### Malware Investigation (Triage)\n**Objective**: Analyze a suspected malicious file hash to determine nature and impact.\n**Inputs**: `${FILE_HASH}`, `${CASE_ID}`.\n**Steps**:\n1.  **Context**:\n    *   **Remote**: `get_case` + `list_case_alerts`.\n    *   **Local**: `get_case_full_details`.\n2.  **SIEM Prevalence**:\n    *   **Remote**: `summarize_entity` (hash).\n    *   **Local**: `lookup_entity` (hash).\n3.  **SIEM Execution Check**:\n    *   **Action**: Search for `PROCESS_LAUNCH` or `FILE_CREATION` events involving the hash.\n    *   **Query**: `target.file.sha256 = \"FILE_HASH\" OR target.file.md5 = \"FILE_HASH\"`\n    *   **Remote**: `udm_search` (using UDM query).\n    *   **Local**: `search_udm` (using UDM query).\n    *   Identify `${AFFECTED_HOSTS}`.\n4.  **SIEM Network Check**:\n    *   **Action**: Search for network activity from affected hosts around execution time.\n    *   **Query**: `principal.process.file.sha256 = \"FILE_HASH\"`\n    *   **Remote**: `udm_search`.\n    *   **Local**: `search_udm`.\n    *   Identify `${NETWORK_IOCS}`.\n5.  **Enrichment**: **Execute Common Procedure: Enrich IOC** for network IOCs.\n6.  **Related Cases**: **Execute Common Procedure: Find Relevant SOAR Case** using hosts\u002Fusers\u002FIOCs.\n7.  **Synthesize**: Assess severity using the matrix below.\n\n    **Severity Assessment Matrix:**\n    | Factor | Low | Medium | High | Critical |\n    |---|---|---|---|---|\n    | **Execution** | Not executed | Downloaded only | Executed | Active C2\u002FSpread |\n    | **Spread** | Single host | 2-5 hosts | 5-20 hosts | > 20 hosts |\n    | **Network IOCs** | None observed | Benign | Suspicious | Known Malicious |\n    | **Data at Risk** | None | Low value | PII\u002FCreds | Critical Systems |\n\n8.  **Document**: **Execute Common Procedure: Document in SOAR**.\n9.  **Report**: Optionally **Execute Common Procedure: Generate Report File**.\n\n### Lateral Movement Investigation (PsExec\u002FWMI)\n**Objective**: Investigate signs of lateral movement (PsExec, WMI abuse).\n**Inputs**: `${TIME_FRAME_HOURS}`, `${TARGET_SCOPE}`.\n**Steps**:\n1.  **Technique Research**: Review MITRE ATT&CK techniques T1021.002 (SMB\u002FWindows Admin Shares) and T1047 (WMI).\n2.  **SIEM Queries**:\n    *   **PsExec Service Installation**:\n        *   `metadata.product_event_type = \"ServiceInstalled\" AND target.process.file.full_path CONTAINS \"PSEXESVC.exe\"`\n    *   **PsExec Execution**:\n        *   `target.process.file.full_path CONTAINS \"PSEXESVC.exe\"`\n    *   **WMI Process Creation**:\n        *   `metadata.event_type = \"PROCESS_LAUNCH\" AND principal.process.file.full_path = \"C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\" AND target.process.file.full_path IN (\"cmd.exe\", \"powershell.exe\")`\n    *   **WMI Remote Execution**:\n        *   `principal.process.command_line CONTAINS \"wmic\" AND principal.process.command_line CONTAINS \"\u002Fnode:\" AND principal.process.command_line CONTAINS \"process call create\"`\n3.  **Execute**:\n    *   **Remote**: `udm_search`.\n    *   **Local**: `search_udm`.\n4.  **Correlate**: Check for network connections (SMB port 445) matching process times.\n5.  **Enrich**: **Execute Common Procedure: Enrich IOC** for involved IPs\u002FHosts.\n6.  **Document**: **Execute Common Procedure: Document in SOAR**.\n\n### Create Investigation Report\n**Objective**: Consolidate findings into a formal report.\n**Inputs**: `${CASE_ID}`.\n**Steps**:\n1.  **Gather Context**:\n    *   **Remote**: `get_case` + `list_case_comments`.\n    *   **Local**: `get_case_full_details`.\n    *   Identify key entities.\n2.  **Synthesize**: Combine findings from SIEM, IOC matches, and case history.\n3.  **Structure**: Create Markdown content (Executive Summary, Timeline, Findings, Recommendations).\n4.  **Diagram**: Generate a Mermaid sequence diagram of the investigation.\n5.  **Redaction**: **CRITICAL**: Confirm no sensitive PII\u002FSecrets in report.\n6.  **Generate File**: **Execute Common Procedure: Generate Report File**.\n7.  **Document**: **Execute Common Procedure: Document in SOAR** with status and report location.\n\n## Common Procedures\n\n### Enrich IOC (SIEM Prevalence)\n**Steps**:\n1.  **SIEM Summary**: `summarize_entity` (Remote) or `lookup_entity` (Local).\n2.  **IOC Match**: `get_ioc_match` (Remote) or `get_ioc_matches` (Local).\n3.  Return combined findings.\n\n### Find Relevant SOAR Case\n**Steps**:\n1.  **Search**: `list_cases` with filters for entity values.\n2.  Return list of `${RELEVANT_CASE_IDS}`.\n\n### Document in SOAR\n**Steps**:\n1.  **Post**: `create_case_comment` (Remote) or `post_case_comment` (Local).\n\n### Generate Report File\n**Tool**: `write_file` (Agent Capability)\n**Steps**:\n1.  Construct filename: `reports\u002F${REPORT_TYPE}_${SUFFIX}_${TIMESTAMP}.md`.\n2.  Write content to file using `write_file`.\n3.  Return path.",{"name":5,"category":43,"personas":44,"description":7,"slash_command":47},"security_operations",[45,46],"incident_responder","tier2_soc_analyst","\u002Fsecurity:investigate","main","d3b74cd8c525d5c10d7e3deed79a814bc9276264","extensions\u002Fgoogle-secops\u002Fskills\u002Finvestigate",152,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmcp-security","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-11 12:37:13",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add google\u002Fmcp-security --skill secops-investigate",{"tool":63,"command":64},"bunx","bunx skills add google\u002Fmcp-security --skill secops-investigate",{"tool":66,"command":67},"pnpm","pnpm dlx skills add google\u002Fmcp-security --skill secops-investigate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmcp-security\u002Fblob\u002Fmain\u002Fextensions\u002Fgoogle-secops\u002Fskills\u002Finvestigate\u002FSKILL.md",true,[],[72,83,111,121],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":38},"01M69932QNNFEWFYK44TJSVCWR","secops-triage","Expert guidance for security alert triage. Use this when the user asks to \"triage\" an alert or case.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmcp-security\u002Fblob\u002Fmain\u002Fextensions\u002Fgoogle-secops\u002Fskills\u002Ftriage\u002FSKILL.md",[],[19,79,80,24,25,34,27,29,31,23,32,81,33,82,37,35],"secops triage","triage","alert","alert triage",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":94,"publishedAt":38},"01M69930CVYPGSF90AD3HBCAZX","secops-setup-gemini","Helps the user configure the Google SecOps Remote MCP Server for Gemini CLI. Use this when the user asks to \"set up\" or \"configure\" the security tools for Gemini CLI.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmcp-security\u002Fblob\u002Fmain\u002Fextensions\u002Fgoogle-secops\u002Fskills\u002Fsetup-gemini-cli\u002FSKILL.md",[89],{"categoryNo":90,"categoryName":91,"taxonomyType":92,"taxonomyTypeDesc":93},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[95,19,96,97,98,99,23,100,101,102,103,104,105,106,107,108,24,109,110,9],"gemini","secops setup gemini","setup","remote","gemini cli","google secops","mcp server","server","SET","Tools","configure","up","engineer","remote mcp","cli","MCP",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":38},"01M6992XXXG0Z8G9QYG2WYGJA9","secops-setup-antigravity","Helps the user configure the Google SecOps Remote MCP Server for Antigravity. Use this when the user asks to \"set up\" or \"configure\" the security tools for Antigravity.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmcp-security\u002Fblob\u002Fmain\u002Fextensions\u002Fgoogle-secops\u002Fskills\u002Fsetup-antigravity\u002FSKILL.md",[117],{"categoryNo":90,"categoryName":91,"taxonomyType":92,"taxonomyTypeDesc":93},[97,119,19,120,23,110,9,100,101,102,103,104,105,33,106,107,98,25,108,24],"secops setup antigravity","antigravity",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":38},"01M6992QV0Y02WPS4R0V9VPE1Y","secops-hunt","Expert guidance for proactive threat hunting. Use this when the user asks to \"hunt\" for threads, IOCs, or specific TTPs.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmcp-security\u002Fblob\u002Fmain\u002Fextensions\u002Fgoogle-secops\u002Fskills\u002Fhunt\u002FSKILL.md",[],[19,128,129,23,130,35,34,33,131,32,31,132,133,134,135,25,24],"hunt","secops hunt","threat hunting","threat","hunter","hunting","threads","proactive"]