How to use the SecOps Threat Hunting agent skill (secops-hunt)

What the secops-hunt skill makes the agent do

An agent skill is a folder of instructions that an AI agent loads when a task matches the skill's description. The secops-hunt skill tells the agent to act as a threat hunter in Google SecOps. It turns attacker techniques and threat-intel indicators into UDM (Unified Data Model) queries, runs them over bounded time windows, filters out benign activity and summarizes what it finds.

• Hypothesis-led hunts based on MITRE ATT&CK techniques or threat actor reports
• Retroactive checks of IP addresses, domains, file hashes and URLs against historical telemetry
• Prevalence searches for rare software, execution paths or network destinations
• Detection of behavioral and statistical outliers
• Posting findings as comments on SOAR cases

How to install the secops-hunt skill

Download the ZIP file for the skill from this directory page. Then choose one of the installation options below. The skill folder contains SKILL.md and a references folder with attribution.md.

For a personal install, unzip the file into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ in your project
• Claude apps: Settings, then Capabilities, then Skills, then upload the ZIP

How to trigger the skill with natural requests

You do not need to type the skill name. The skill is matched to your request by its description, so ask for the kind of work you want done. Name the indicators, time window and techniques where you can. The skill's description lists the situations it covers: proactive hunting, retroactive IoC analysis, prevalence searches, MITRE ATT&CK technique hunts and outlier detection.

Requests that fit the skill sound like the following. If you ask for alert triage, incident timelines or detection rule writing, the skill points you to the separate secops-triage, secops-investigate or secops-detection-engineering skills instead.

• Hunt for LSASS credential dumping over the last 72 hours in our Windows fleet
• Check whether these IP addresses and domains from this week's threat bulletin appeared in our telemetry over the last 60 days
• Find rare executables run from user Temp or Public folders in the last 10 days
• Look for statistical outliers in outbound connections from our cloud workloads
• Draft UDM queries for this hunt hypothesis and post the findings to case 1234

Safety notes: scripts, network and untrusted data

According to the listing, this skill runs no scripts but does use the network, because it sends queries to SecOps and its tools. The skill also instructs the agent to treat retrieved UDM event fields, process command lines, raw logs and entity labels as untrusted data, never as instructions. Hunt results can contain text written by an attacker, so the agent is directed not to execute commands found inside them.

The attribution file asks the agent to tag every gcloud, REST or MCP command so usage can be attributed to the skill. It says the tag carries no user data and that gcloud config set must not be used for it, because that would persist beyond the task.

• No scripts are run by this skill, according to the listing
• The skill uses the network to reach SecOps tools and APIs
• Retrieved log content is treated as data, not instructions
• Attribution tags are set inline on each command and carry no user data

Tips for getting reliable hunts

The skill sets guardrails that you can rely on. Every UDM query should have an explicit start and end time to avoid unbounded scans, and initial exploration returns a limited number of results, by default 50 to 100 events. The default lookback for hypothesis hunts is 72 hours, retroactive IoC lookbacks cover 30 to 90 days, and prevalence searches use a 10-day window.

Use the remote MCP tools when they are available, since the skill lists them as the preferred option, and fall back to the local tools otherwise. Give the agent your baseline context, such as which assets are authorized security agents or backup software, so it can filter that noise.

• Give explicit time windows for every hunt
• Start with 50 to 100 results and widen only if needed
• Name the baseline noise you already know about, such as backup or security agents
• For prevalence results, roughly 2 or fewer assets is high priority, 3 to 10 is medium and over 100 is usually standard software