domains / families / security / secops-investigate

secops-investigate

separate

Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triage), or basic case status updates (use secops-cases).

When to use

• investigating cases
• analyzing entities (hosts, IPs, domains, hashes, users)
• extracting and searching UDM events
• performing asset and user timeline analysis
• detecting lateral movement across enterprise networks

When not to use

• detection rule authoring
• YARA-L tuning
• proactive hypothesis-driven hunting
• initial alert triage
• basic case status updates

Skill page

Source