What problem does it solve? Security analysts need a fast way to determine whether a suspicious file hash has been observed inside their environment. This Skill retrieves a Chronicle SIEM entity summary for a file hash, showing internal sightings, related alerts, and first/last seen times without manual console queries. ## Core Features & Use Cases - Entity Lookup: Calls the secops-mcp lookup_entity tool with a file hash (MD5, SHA1, or SHA256) and a configurable lookback window (default 72 hours). - Structured Outputs: Returns the Chronicle entity summary plus parsable fields such as related alert count and observed host count, with a clear status of Success, NoInfoFound, or Failure. - Decision Logic: Automatically flags hashes for further internal investigation when activity is observed and routes to process event search runbooks. - Use Case: After an external reputation check flags a SHA256 hash as suspicious, run this Skill to see whether any internal hosts executed or observed the file in the last three days. ## Quick Start Look up the file hash 44d88612fea8a8f36de82e1278abb02f in Chronicle for the last 72 hours and summarize any internal activity and related alerts.
