Trace security incidents across hosts and users.
What it does
Investigates security incidents in Google SecOps to produce evidence-backed timelines, impact assessments, and containment recommendations.
When to use it
Use for deep case and entity investigations, security event searches, asset and user timeline analysis, and lateral movement detection.
How to use it
Give it an alert, case ID, entity, or indicator of compromise; it investigates and produces an incident report with SOAR documentation.
What you provide
- an alert, case ID, entity, or IoC
Uses
GS
Good to know
- cannot be undone: Google SecOps
Latest review
What you need · 1
Requires access to the Google SecOps environment containing the security incidents and telemetry to investigate.
Access · 1
This skill
Google SecOps
Write
Posts investigation notes to SecOps (irreversible)