from mcp-security460
Expert, tool-aware guidance for proactive threat hunting: formulate SIEM/UDM queries, iterate searches, enrich findings, and produce case or report outputs.
Acts as a playbook and guided operator for proactive threat hunting. It instructs the agent to detect available tools, construct appropriate queries (UDM or local SIEM), iterate searches for IOCs/TTPs, enrich suspicious entities, and document findings into cases or reports. The skill maps high-level hunt objectives to concrete steps and tool calls.
Use when an analyst asks to hunt for indicators, investigate suspected TTPs, or run a focused search (e.g., specific MITRE ATT&CK techniques, campaign IDs, or IOC lists). Appropriate for environments with remote search tools (udm_search/get_ioc_match) or local SIEM functions. Trigger phrases include "hunt", "threat hunt", "search for IOCs", or "investigate TTP".
Designed for SecOps-capable agents that can call remote search tools or local SIEM connectors (Google SecOps integrations, UDM-capable agents).
This skill has not been reviewed by our automated audit pipeline yet.
