What problem does it solve? Security analysts need a fast way to check whether an IP address has been active inside their environment before deciding how deep to investigate. This Skill queries Chronicle SIEM's entity graph to return a summary of an IP's internal interactions, related alerts, and first/last seen timestamps within a configurable time window. ## Core Features & Use Cases - Entity Activity Lookup: Calls the secops-mcp lookup_entity tool with an IP address and optional hours_back window (default 24 hours). - Structured Outcomes: Returns a Chronicle entity summary plus a status of Success, NoInfoFound, or Failure, with optional parsing of related alert counts and seen timestamps. - Guided Triage Decisions: Includes decision logic that flags high-activity IPs for deeper network traffic analysis and escalates failures to human analysts. - Use Case: After an external threat intelligence check flags an IP as suspicious, run this Skill to see whether that IP touched any internal assets in the last 24 hours and whether it triggered related alerts. ## Quick Start Look up the IP address 203.0.113.10 in Chronicle for the last 24 hours and summarize its internal activity and related alerts.
