skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

user-lookup-entity-chronicle

Retrieves user entity activity summaries from Chronicle SIEM using the lookup_entity tool.

85|14|Updated May 17, 2025
Search Tags:#secops#entity#chronicle#siem#user lookup#threat investigation#lookup_entity
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill user-lookup-entity-chronicle-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: user-lookup-entity-chronicle
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/user-lookup-entity-chronicle
Command: npx skills add https://github.com/dandye/adk_runbooks --skill user-lookup-entity-chronicle-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need a fast way to check whether a username from an alert, phishing report, or HR termination list shows suspicious activity in Chronicle SIEM without writing manual queries. ## Core Features & Use Cases - Entity Lookup: Calls the secops-mcp lookup_entity tool to summarize a user's logins, accessed systems, related alerts, and first/last seen times over a configurable lookback window (default 72 hours). - Decision Logic: Flags users as suspicious when related alerts, unusual login locations, or abnormally high host counts appear, and routes to deeper login and process activity searches. - Use Case: An alert references user jdoe; run this lookup to get a Chronicle activity summary and determine whether a deeper investigation of that account is warranted. ## Quick Start Look up user jdoe in Chronicle for the last 72 hours and summarize their logins, accessed hosts, and related alerts.

Frequently Asked Questions about user-lookup-entity-chronicle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I look up a user's activity in Chronicle SIEM?▼

Call the lookup_entity tool on the secops-mcp server with the username as entity_value and an optional hours_back parameter (default 72). The tool returns a textual summary of logins, accessed systems, related alerts, and first/last seen times.

What inputs does the Chronicle user entity lookup require?▼

It requires a username string, such as one from an alert's principal.user.userid field or an email sender. An optional hours_back integer controls the historical window and defaults to 72 hours.

Does the username format matter for Chronicle entity lookup?▼

Yes. Usernames may need a specific format such as UPN or samaccountname depending on how they are parsed into UDM. Consult the data normalization map if the input username needs translation to match principal.user.userid.

What happens when no activity is found for a user in Chronicle?▼

The runbook sets output_status to NoInfoFound and logs that no activity exists for the user in the specified window. A Failure status instead logs the error message and escalates the lookup failure.

When should I escalate after a Chronicle user lookup?▼

Escalate to deeper investigation when the summary shows related alerts, logins from unusual locations, or access to an unusually high number of hosts. The runbook then routes to user login and process activity search runbooks.

Related Skills

Explore More Software Engineering Skills→
neuron-oneneuron-one
25

nimble

Extracts structured data from multiple websites into normalized JSON tables.

Community
Intermediate
datadog-labsdatadog-labs
150

dd-audit-key-compromise

Analyze Datadog audit logs for compromised API key usage history.

Official
Advanced
msandbumsandbu
2

honeypot-investigation

Automates security analysis of honeypot servers by querying failed connections and enriching IPs with threat intelligence.

Community
Advanced
sparq-orgsparq-org
8

genai-retrieval

Introspect RDF datasets and retrieve information via SPARQL with GenAI natural language queries.

Official
Advanced