skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

domain-lookup-entity-chronicle

Retrieves domain entity activity summaries and related alerts from Chronicle SIEM.

85|14|Updated May 17, 2025
Search Tags:#incident response#secops#threat intelligence#chronicle#siem#entity graph#domain lookup
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill domain-lookup-entity-chronicle-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-lookup-entity-chronicle
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/domain-lookup-entity-chronicle
Command: npx skills add https://github.com/dandye/adk_runbooks --skill domain-lookup-entity-chronicle-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need a quick way to check whether a suspicious domain or FQDN has generated internal activity before deciding how deep to investigate. This Skill queries Chronicle SIEM for a domain's entity graph associations, related alerts, and first/last seen times, eliminating manual console lookups during triage. ## Core Features & Use Cases - Entity Lookup via MCP: Calls the secops-mcp lookup_entity tool with a domain name and configurable lookback window (default 24 hours). - Structured Decision Logic: Classifies results as Success, NoInfoFound, or Failure, and routes high-activity domains to follow-up DNS and network traffic runbooks. - Use Case: During alert triage, an analyst receives a suspicious FQDN from a phishing alert. After checking external reputation, they run this Skill to see whether internal hosts queried the domain, which IPs it resolved to, and whether related Chronicle alerts exist. ## Quick Start Look up the domain 'evil-example.com' in Chronicle for the last 48 hours and summarize its internal activity and related alerts.

Frequently Asked Questions about domain-lookup-entity-chronicle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I look up a domain's activity in Chronicle SIEM?▼

Use the lookup_entity tool from the secops-mcp server with the domain name as entity_value and an optional hours_back window. The tool returns a textual summary of DNS queries, resolved IPs, related alerts, and first/last seen times.

What is the default time range for a Chronicle entity lookup?▼

The default lookback window is 24 hours, controlled by the hours_back parameter. You can increase it to gain broader historical context when investigating older or low-frequency domain activity.

When should I run a domain entity lookup during incident triage?▼

Run it after external reputation checks, such as a Google Threat Intelligence report, when you need to confirm internal exposure. It shows whether internal hosts queried the domain and whether related Chronicle alerts exist.

What happens if no activity is found for a domain in Chronicle?▼

The runbook returns a NoInfoFound status and logs that no activity was observed for the domain in the specified window. No escalation occurs, though you may widen hours_back or pivot to external intelligence sources.

What are the next steps after a domain shows high internal activity?▼

High-activity domains are flagged for further internal investigation. The runbook directs you to DNS search and network traffic search runbooks in Chronicle, and to IP-specific atomic runbooks for each resolved IP found in the summary.

Related Skills

Explore More Software Engineering Skills→
afoxnyc3afoxnyc3

threat-intel

Query Mimecast threat intelligence to score email sender, domain, or IP reputation.

Community
Intermediate
jwm-axonijwm-axoni
3

recon

Map network infrastructure via passive and authorized active reconnaissance.

Community
Advanced
Liberty91LTDLiberty91LTD
15

lookup-virustotal

Query VirusTotal for IP, domain, hash, and URL reputation reports.

Official
Intermediate
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced