SecOps Alert Triage
Guides an agent through triaging Google SecOps alerts: classify false/true positives, assess entity risk, adjust severity, close or escalate.
- Repository
- google/skills
- Stars
- 21,782
- Licence
- Apache-2.0
- Files
- 10 files
What it does
Once installed, the agent follows a structured playbook for handling security alerts and cases in Google Security Operations (a SIEM/SOAR platform). It gathers the alert's details, checks for duplicate cases, runs suggested log searches around the alert time, weighs how risky the involved users, hosts, IPs and files are, and then recommends whether to close the alert as a false or benign positive, adjust its priority, or hand it to incident response. It also tells the agent which tools to prefer and to treat alert contents as untrusted data rather than instructions.
Great for
- SOC analysts who want a consistent, repeatable triage routine in Google SecOps
- Security engineers building or testing an agent-assisted alert queue
- Teams that want clear handoffs between triage and deeper investigation skills
Skip it if
- Deep multi-host incident timelines or proactive threat hunting: the skill itself points these to other skills (secops-investigate, secops-hunt) because it is scoped to triage only
- Users without access to Google SecOps: the workflow depends on that platform's case, alert and search tools; without them the agent cannot act on real alerts
- Fully unattended closing of alerts: the skill can close cases in bulk, so a human should review decisions before relying on them for real incidents
Try asking
- “Triage the open alerts for case 12345 and tell me which look like false positives”
- “Check whether this new alert duplicates an existing case involving user jdoe and close it if so”
- “Assess the risk of the IP and file hash in this alert and recommend a severity change”
- “Search UDM logs for the two hours around this login alert and summarise any impossible travel”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 10 original files, the Apache-2.0 licence and an attribution note.
secops-triage.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip secops-triage.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip secops-triage.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Give the agent a specific case or alert ID so it can pull full details before reasoning about risk.
- Review any close or priority-change action before it is executed, especially bulk closures.
- Pair with the referenced secops-investigate skill when a triage result turns into a true positive that needs a deeper timeline.
What's inside
- references/01_keycloak_identity.md
- references/02_gcp_iam_compute_and_keys.md
- references/03_kubernetes_and_containers.md
- references/04_endpoint_auditd_vss_and_linux_containers.md
- references/05_network_dns_webrtc_and_gti.md
- references/06_mssp_and_cmdb_enrichment.md
- references/07_pfsense_firewall_and_wireguard.md
- references/08_hybrid_ad_cloud_and_cisa_aa26_237a.md
- references/attribution.md
- SKILL.md
Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.