secops-hunt

Expert guidance for proactive threat hunting. Use this when the user asks to "hunt" for threads, IOCs, or specific TTPs.

2.02x

Quality

57%

Does it follow best practices?

Impact

97%

2.02x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./extensions/google-secops/skills/hunt/SKILL.md

Evaluation results

99%

74%

Threat Hunt Playbook: APT29 Infrastructure Indicators

IOC hunt query formulation

Criteria

Without context

With context

IP query fields

100%

Domain query fields

100%

Hash query fields

100%

URL query field

100%

Initial IOC scan tool

100%

Remote vs Local distinction

50%

100%

Two-phase structure

100%

Phase 2 context scope

100%

Related case search

37%

100%

Output options

100%

Report format

83%

SOAR case posting

100%

31%

Credential Theft Hunt Playbook

TTP hunt loop methodology

Criteria

Without context

With context

MITRE research step

100%

Hunt loop structure

100%

udm_search for execution

12%

100%

Noisy result handling

100%

Empty result handling

100%

Loop termination condition

100%

Entity enrichment Remote

100%

Entity enrichment Local

100%

Documentation step

100%

Escalation step

100%

Remote vs Local awareness

25%

100%

Anomaly analysis

100%

93%

43%

GTI Campaign Hunt: Finding Related Cases and Reporting

GTI campaign hunt workflow and SOAR integration

Criteria

Without context

With context

Initial scan tool named

100%

IP query syntax

33%

100%

Domain query syntax

22%

100%

URL query syntax

62%

100%

Phase 2 context investigation

100%

list_cases usage

100%

Case detail lookup

Findings synthesis

87%

100%

Next steps options

100%

Markdown format

100%

Remote vs Local tools noted

100%

SOAR case action described

90%

100%

Repository: google/mcp-security
Commit: 9774ce8

Evaluated: 29 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Threat Hunt Playbook: APT29 Infrastructure Indicators Credential Theft Hunt Playbook GTI Campaign Hunt: Finding Related Cases and Reporting

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.