secops-investigate
secops-investigate is an agent skill published by google, listed under deploy & operate. It lives in the google/skills repository, which has 21,580 GitHub stars and is licensed under Apache-2.0; we last read it on 2026-10-23.
Provides expert guidance for deep security incident and entity investigations in Google SecOps, connecting to UDM events for extraction and searching, and performing asset and user timeline analysis. Requires no specific credentials.
Install
skills is a generic installer for any repository of Claude agent skills -- it reads google/skills’s own structure rather than assuming one, the same way this page reads the skill’s own SKILL.md rather than assuming a format.
npx skills add google/skills
Maintenance
Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triage), or basic case status updates (use secops-cases).
secops-investigate compared with similar skills
| Skill | Publisher | What it does | Repo stars | Last update |
|---|---|---|---|---|
| secops-investigate (this page) | Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating… | 21,580 | 2026-10-25 | |
| agent-platform-endpoint-management(same repository) | Manages Agent Platform serving endpoints. Use when you need to create, list, describe, update, or delete serv… | 21,580 | 2026-10-25 | |
| agent-platform-model-registry(same repository) | Agent Platform Model Registry Management. Use when you need to upload, list, describe, update, or delete mach… | 21,580 | 2026-10-25 | |
| application-design-center-design-deploy(same repository) | Processes GCP infrastructure design and deployment workflows within Application Design Center (ADC). Use when… | 21,580 | 2026-10-25 | |
| cloud-build-basics(same repository) | Teaches the fundamentals of Cloud Build on Google Cloud. Covers core concepts, API enablement, console naviga… | 21,580 | 2026-10-25 | |
| cloud-monitoring-chart-generation(same repository) | Generates Cloud Monitoring Server-Driven UI (SDUI) Widget and XyChart Protocol Buffer textprotos on Google Cl… | 21,580 | 2026-10-25 | |
| cloud-monitoring-metric-selection(same repository) | Retrieve, query, and identify relevant Cloud Monitoring metric descriptors on Google Cloud for a service or r… | 21,580 | 2026-10-25 |
Skills from the same repository first, then others for this job by repository stars. Figures are from each repository when we last read it.
Common questions about secops-investigate
- What does secops-investigate do?
- Provides expert guidance for deep security incident and entity investigations in Google SecOps, connecting to UDM events for extraction and searching, and performing asset and user timeline analysis. Requires no specific credentials.
- How do I install secops-investigate?
- Run npx skills add google/skills. The skills installer reads the repository’s own structure, so it works for any repository of agent skills.
- Who publishes secops-investigate?
- google.
- Is secops-investigate maintained, and what licence does it use?
- Its repository has 21,580 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-10-25. The repository declares the Apache-2.0 licence.
More agent skills for deploy & operate
- ai-content-pipelineby 101-skills
- explainer-video-guideby 101-skills
- ci-cd-and-automationby addyosmani
- observability-and-instrumentationby addyosmani
- internal-commsby anthropic
- xlsxby anthropic