Triage Google SecOps alerts into clear decisions.
What it does
Classifies security alerts in Google SecOps, assesses entity risk, and updates cases for closure or escalation.
When to use it
Use for security alert triage, false-positive assessment, entity risk assessment, priority adjustments, and case closure or escalation.
How to use it
Give it an alert ID or case ID; it investigates the detection and updates the case for closure or escalation.
What you provide
- an alert ID or case ID
Uses
Good to know
- cannot be undone: Google SecOps
What you need · 3
Requires access to Google SecOps case operations, SIEM telemetry, and entity intelligence through available remote MCP tools or local tools.
Hands off deep host timeline investigation and root cause analysis to this skill; whether it must be installed to complete triage is unstated.
Access · 2
This skill
Google SecOps
Updates and closes security cases (irreversible)
Google Threat Intelligence
Checks threat intelligence matches