How does the skill handle different security toolsets?

It automatically detects if you are using Local or Remote tools and adapts its workflow, mapping capabilities to the correct tool via a built-in tool mapping configuration.

How do I initiate a hunt?

You can trigger the specialized threat hunter persona by using the slash command /security:hunt within the Claude Code interface.

Does it require manual UDM query writing?

No, the skill translates natural language intent and indicator types into valid UDM queries automatically, though users can refine them as needed.

Can I use this for incident response?

Yes, while designed for proactive hunting, its ability to find relevant SOAR cases and enrich entity data makes it highly effective for reactive incident investigation.

What platforms does this skill support?

This skill is optimized for environments utilizing Google SecOps (Chronicle) and SIEMs that support Unified Data Model (UDM) searches.

SecOps Threat Hunting

Name: SecOps Threat Hunting
Author: majiayu000

bymajiayu000

•

安全与测试

Performs proactive threat hunting and security analysis to identify undetected threats, IOCs, and TTPs within your environment.

This skill empowers Claude to act as an expert Threat Hunter, providing structured workflows for identifying stealthy threats before they escalate. It enables security analysts to search for Indicators of Compromise (IOCs) such as IPs, domains, and hashes, while also offering guided procedures for hunting specific MITRE ATT&CK techniques. By intelligently mapping to available security tools like Google SecOps and SIEM environments, it automates UDM query generation, correlates suspicious entity behavior, and streamlines SOAR case management through automated reporting and escalation.

主要功能

01Proactive IOC scanning for IPs, domains, hashes, and URLs

02Automated UDM query generation and SIEM search execution

0394 GitHub stars

04Intelligent tool selection for Local vs. Remote environments

05Guided TTP hunting based on MITRE ATT&CK techniques

06Integrated SOAR case management and markdown report generation

使用场景

01Hunting for indicators related to a specific GTI threat actor campaign

02Synthesizing SIEM events to update or create new SOAR investigation cases

03Detecting evidence of OS Credential Dumping (T1003) across the infrastructure

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add majiayu000/claude-skill-registry security-operations

For use in Claude.ai and ChatGPT

Download Skill