← All skills

secops-hunt

90 / 100 · Low risk

Fine to try.

By google/skills (GitHub) · security · 23,813 stars · scanned at commit 793c036

Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of compromise (IoCs), performing prevalence searches across enterprise events, hunting for MITRE ATT&CK techniques, or detecting behavioral and statistical outliers using UDM queries. Don't use for incoming alert triage (use secops-triage), active incident response and timeline deep-dives on a known breach (use secops-investigate), or detection rule authori…

Works with any agent that supports SKILL.md skills.

What this skill can do

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'secops-hunt' ] || [ -L ~/.agents/skills/'secops-hunt' ]; then echo 'A skill folder named secops-hunt already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/google/skills' "$d" && git -C "$d" checkout --quiet '793c036c3af827151ada918c5f8cba823ef7086d' -- 'skills/cloud/secops-hunt' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/cloud/secops-hunt' ~/.agents/skills/'secops-hunt' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'secops-hunt' ~/.claude/skills/'secops-hunt' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for google/skills shows the score of its lowest-scoring skill.

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/google/skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/google/skills/)

Score history