FreeSkills
Commits, branches and sync with the but CLI
- 361361 downloads
- 198198 likes
- 103103 saves
Works with
- Claude Code
- Codex
- Cursor
- and 3 more
Incident and entity investigation in Google SecOps v1.0.0
Use this resource to investigate a security incident and the entities involved in Google SecOps
New
- 463 downloads
- 219 likes
- 176 saves
Free
Install with the CLI
In a terminal, from the folder you want:
npx --yes palatekit@latest install secops-incident-entity-investigationWith no option, the skill goes to ~/.agents/skills/; add --agent claude-code (or codex, cursor…) to target an agent.
First time: connect the CLI with
npx --yes palatekit@latest loginThe agent works as a Tier 2 or 3 SOC analyst: it searches and extracts UDM events, rebuilds asset and user timelines and looks for lateral movement. You get an investigation summary backed by the events found.
Mostly picked by
Updated November 2, 2026
Previews
Details
- Install guides
- Generates with
- Your agent's model
- Licence
- Apache-2.0
Similar resources
View all- Free
FreeSkills
Sentry CLI guide
- 525525 downloads
- 117117 likes
- 128128 saves
Works with- Claude Code
- Codex
- Cursor
- and 3 more
FreeSkills
Drizzle ORM best practices with PostgreSQL
- 407407 downloads
- 194194 likes
- 151151 saves
Works with- Claude Code
- Codex
- Cursor
- and 3 more
FreeSkills
SLO design wizard
- 537537 downloads
- 105105 likes
- 242242 saves
Works with- Claude Code
- Codex
- Cursor
- and 3 more
FreeSkills
User stories and sprint fit
- 451451 downloads
- 150150 likes
- 132132 saves
Works with- Claude Code
- Codex
- Cursor
- and 3 more
FreeSkills
Capacity-based sprint plan
- 423423 downloads
- 192192 likes
- 102102 saves
Works with- Claude Code
- Codex
- Cursor
- and 3 more
FreeSkills
Startup CTO advisor
- 580580 downloads
- 201201 likes
- 242242 saves
Works with- Claude Code
- Codex
- Cursor
- and 3 more
FreeSkills
Creating GitHub pull requests with quality checks
- 427427 downloads
- 230230 likes
- 196196 saves
Works with- Claude Code
- Codex
- Cursor
- and 3 more
What you get
- SKILL.md: investigation strategy, UDM queries, and timeline and lateral movement analysis
- references/attribution.md: attribution rules for gcloud commands and the API
Good fit for
- An incident spans several hosts and accounts and the timeline must be rebuilt
- You need to check whether the same host or IP appears elsewhere on the network
Not for
Tags
- siem
- investigation
- security
- udm
About
You say
“Investigate host srv-fin-04 and IP 203.0.113.17: timeline for the last 48 hours and signs of lateral movement.”
Skill published by google under the Apache-2.0 license, delivered in its original version.
Show moreShow less
How to use it
- Install the skill in your agent's skills folder
- Ask your agent to investigate a security incident and the entities involved in Google SecOps
- Review and adjust the result
Content preview
Files
- LICENSE11.3 KB
- NOTICE-PALATEKIT.md0.5 KB
- references/attribution.md1.9 KB
- SKILL.md18.8 KB
Origin and licence
Listed unmodified
- Author
- Source
- github.com/google/skills/tree/81b0e8f8f40513c31b3388e600506e8b48a85bc2/skills/cloud/secops-investigate
- Licence
- Apache-2.0
Notice
« secops-investigate » (google, Apache-2.0) livré dans sa version d'origine : fiche en français et en anglais par PalateKit.
User reviews
–
No ratings yet
Loading reviews…