Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks.
Install
npx skills add google/skills --skill secops-investigatenpx skills add google/skills --skill secops-investigate -a claude-code -gnpx skills add google/skills --skill secops-investigate -a codex -ggemini skills install https://github.com/google/skills.git --path skills/cloud/secops-investigategh skill install google/skills secops-investigategit clone --depth 1 https://github.com/google/skills /tmp/google__skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/google__skills/skills/cloud/secops-investigate ~/.claude/skills/secops-investigate # Claude Code
cp -R /tmp/google__skills/skills/cloud/secops-investigate ~/.agents/skills/secops-investigate # Codex, Cursor, Gemini CLI, Copilot, OpenCode