What problem does it solve? Security analysts investigating a suspicious URL need to know whether internal hosts communicated with it, but manually writing Chronicle SIEM queries for URL activity is slow and error-prone. This Skill standardizes that search so an AI agent can quickly find all network events tied to a URL. ## Core Features & Use Cases - Flexible Search Strategies: Supports ExactURL, DomainAndPath, DomainOnly, and ResolvedIPs search modes to handle different investigation needs. - Structured UDM Query Generation: Builds natural-language queries for the secops-mcp search_security_events tool with configurable time windows and event limits. - Actionable Output: Returns matching UDM events, the translated query, and a deduplicated list of source hosts that accessed the URL. - Use Case: After a threat intelligence report flags malicious.example.com/payload.exe as harmful, run this Skill to identify every internal host that requested it in the last 24 hours and decide whether containment is needed. ## Quick Start Search Chronicle for all events related to the URL https://suspicious.example.com/download over the past 48 hours using the DomainAndPath strategy.
