Results for “search case tuning”

Use when the user provides 1-50 concrete bad-case search queries for one Viking Search app and wants local deterministic fixes. This skill only verifies request-level fine-operation interventions against a read-only baseline scene and delivers a console-ready configuration sheet, validated payloads, and a replay script. It must not mutate scenes, apps, dictionaries, datasets, recall core parameters, or online defaults.

The English summary is being prepared. Showing the original description.

Investigate security incidents in Google SecOps by connecting host, user, and network events. Reconstruct attack timelines, trace movement between systems, assess affected assets, and organize findings into case notes and investigation reports.

• Reconstruct a suspicious host's activity timeline
• Investigate unusual user logins and resource access
• Trace attacker movement between systems

Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triage), or basic case status updates (use secops-cases).

The English summary is being prepared. Showing the original description.