What problem does it solve? Security analysts often need deeper visibility than a high-level entity summary provides when investigating a suspicious IP address. This Skill performs a detailed search of UDM network connection events in Chronicle SIEM, returning the raw event records needed to identify suspicious patterns like beaconing, unusual ports, or large data transfers. ## Core Features & Use Cases - Targeted UDM Event Search: Queries Chronicle via the secops-mcp search_security_events tool for network traffic where the IP appears as principal or target. - Configurable Query Parameters: Supports adjustable lookback windows (hours_back), result limits (max_events), and additional UDM filter terms such as protocol or port conditions. - Structured Output & Decision Logic: Returns UDM events, the translated query, total match counts, and a status field, with explicit next-step guidance for success, no-results, and failure cases. - Use Case: After an entity lookup flags IP 192.168.1.100 as suspicious, run this Skill to retrieve all network connections involving that IP over the last 48 hours, then analyze destination ports and protocols for signs of lateral movement. ## Quick Start Search Chronicle for all network traffic involving IP address 203.0.113.50 over the last 24 hours and summarize the destination ports and protocols.
