hash-search-process-events-chronicle

What problem does it solve? Analysts investigating a suspicious file hash need to know where and how that file was executed across the environment, but manually building UDM queries against Chronicle SIEM is slow and error-prone. This Skill provides a repeatable procedure for searching process launch and file-related events tied to a specific hash. ## Core Features & Use Cases - UDM Query Construction: Builds natural-language queries for the secops-mcp search_security_events tool using the correct hash-type UDM field (e.g., principal.process.file.sha256). - Structured Output Extraction: Returns affected hosts, executed command lines, event timestamps, and a translated UDM query for auditing. - Decision Logic: Defines next steps for success, no-results, and failure outcomes, including escalation guidance for widespread malicious execution. - Use Case: After an entity lookup confirms a malicious SHA256 was seen internally, run this Skill to enumerate every host that executed it and inspect the associated command lines for further IOCs. ## Quick Start Search Chronicle for all process launch events involving SHA256 hash abc123 over the last 72 hours and list the affected hosts and command lines.