Secops Router

The primary router to discover Google SecOps capabilities.

goog-cmmartin Updated

File contents

Google SecOps Capabilities Index

This provides a local CLI to interact with Google SecOps (Chronicle) via the MCP API.

🧭 Routing

When requested to perform a SecOps task, use the skill tool to load the corresponding persona file below to learn the correct commands and schema.

  • Cases, Alerts & SOAR Enrichment: For all case management, alert triage, playbook review, and enrichment action execution. 👉 skill({ name: "secops-cases" })
  • Detection Engineering: For creating and managing YARA-L Rules, Reference Lists, and Data Tables. 👉 skill({ name: "secops-detection-eng" })
  • Threat Hunting & Investigations: For summarizing entities and running raw UDM searches. 👉 skill({ name: "secops-threat-inv" })
  • Ingestion Architecture: For importing raw logs and testing parsers. 👉 skill({ name: "secops-ingestion" })

goog-cmmartin/secops-agent-skills/tree/main/skills/secops-router commit 53f28fed77

Frequently asked questions

npx skillmds@latest add goog-cmmartin/secops-router