skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

user-search-login-activity-chronicle

Searches Chronicle SIEM for user login events using natural language security event queries.

85|14|Updated May 17, 2025
Search Tags:#incident response#threat hunting#chronicle#siem#udm#security events#login activity
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill user-search-login-activity-chronicle-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: user-search-login-activity-chronicle
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/user-search-login-activity-chronicle
Command: npx skills add https://github.com/dandye/adk_runbooks --skill user-search-login-activity-chronicle-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need a repeatable way to investigate a specific user's login activity in Chronicle SIEM without manually crafting UDM queries, especially when triaging suspicious account behavior or following up on entity lookups. ## Core Features & Use Cases - Login Event Search: Queries Chronicle via the secops-mcp search_security_events tool for successful and failed logins tied to a username. - Flexible Filtering: Supports configurable time windows (default 72 hours), event limits, and outcome filters (Successful, Failed, or Any). - Structured Outputs: Returns login events, unique source IPs, target systems, and a status indicator for downstream analysis. - Use Case: After an alert flags unusual behavior for user 'jdoe', run this runbook to pull all failed logins in the last 24 hours, then correlate the source IPs with threat intelligence to detect brute-force or impossible-travel patterns. ## Quick Start Search Chronicle for all failed login events for user 'jdoe' over the past 24 hours and summarize the source IPs and target systems.

Frequently Asked Questions about user-search-login-activity-chronicle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search for user login events in Chronicle SIEM?▼

Provide a username and optionally a time window, event limit, and outcome filter. The runbook builds a natural language query and calls the secops-mcp search_security_events tool, returning UDM login events with timestamps, source IPs, and target systems.

How to filter failed vs successful logins in Chronicle?▼

Set the login_outcome_filter parameter to Successful, Failed, or Any. Failed logins map to outcomes like FAILED_LOGIN or BLOCK, while successful logins map to SUCCESSFUL_LOGIN or ALLOW in UDM security_result fields.

What is the default time range for Chronicle login searches?▼

The default lookback window is 72 hours (3 days) with a maximum of 100 event records. Both values can be overridden using the hours_back and max_events input parameters.

What should I do when no login events are found in Chronicle?▼

A NoEventsFound status means no matching login events exist for that user in the specified window. Try expanding hours_back, removing the outcome filter, or verifying the username format matches what Chronicle ingests.

Can Chronicle login results be correlated with threat intelligence?▼

Yes. The runbook outputs unique source IPs from login events, which can be passed to a GTI IP report runbook to identify suspicious geolocations, brute-force patterns, or impossible travel.

Related Skills

Explore More Software Engineering Skills→
Bishwas-pyBishwas-py

ban-user

Ban users by ID, username, or email with soft-deletion and audit logging.

Community
Intermediate
Liberty91LTDLiberty91LTD
15

lookup-abuseipdb

Retrieve AbuseIPDB abuse-report history for an IP address.

Official
Intermediate
Renzo-TognellaRenzo-Tognella

detecting-anomalous-authentication-patterns

Detect anomalous authentication patterns in logs using UEBA and machine learning.

Community
Advanced
alon3153alon3153

detection-engineering-coverage-evaluation

Automates detection coverage evaluation and YARA-L rule generation in Google SecOps.

Community
Advanced