skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

user-search-process-activity-chronicle

Searches Chronicle SIEM for process launch events associated with a specific user.

85|14|Updated May 17, 2025
Search Tags:#incident response#threat hunting#security operations#chronicle#siem#udm#process search
One-click install
npx skills add https://github.com/dandye/adk_runbooks --skill user-search-process-activity-chronicle-dandye
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: user-search-process-activity-chronicle
Source: https://github.com/dandye/adk_runbooks/tree/main/skills/atomic/user-search-process-activity-chronicle
Command: npx skills add https://github.com/dandye/adk_runbooks --skill user-search-process-activity-chronicle-dandye

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security analysts need to know which processes and commands a specific user executed across endpoints, but manually querying Chronicle SIEM for user process activity is slow and error-prone. This Skill provides a structured runbook for retrieving process launch events tied to a username. ## Core Features & Use Cases - User Process Search: Queries Chronicle via the secops-mcp search_security_events tool for process launches by a given username. - Flexible Filtering: Supports optional filters for time window, hostname, and process name (e.g., powershell.exe). - Structured Outputs: Returns process events, executed commands, involved hosts, and a status indicator for downstream triage. - Use Case: After detecting a suspicious login for user 'jdoe', run this Skill to list every command that user executed in the last 24 hours and identify malicious activity. ## Quick Start Search Chronicle for all process launch events by user 'jdoe' on host 'workstation123' in the last 24 hours.

Frequently Asked Questions about user-search-process-activity-chronicle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search Chronicle for processes launched by a specific user?▼

Provide the username to the search_security_events tool via secops-mcp with a natural language query like "Process launch events for user 'jdoe' in the last 24 hours". The runbook maps parameters and returns UDM process events with command lines and hostnames.

How to filter Chronicle process search by hostname or process name?▼

Pass the optional target_hostname and process_name_filter inputs, which are appended to the query text. For example, filtering for 'powershell.exe' on 'workstation123' narrows results to that host and process.

What Chronicle tool does user process activity search use?▼

It uses the search_security_events tool from the secops-mcp server. The tool accepts a natural language text query plus hours_back and max_events parameters, and returns UDM-formatted security events.

What happens when no process events are found for a user in Chronicle?▼

The runbook returns output_status "NoEventsFound" and logs that no process launch events matched the criteria for the given time window. You can widen hours_back or remove filters to broaden the search.

What are the limitations of searching user process activity in Chronicle?▼

Results depend on Chronicle having ingested endpoint process launch telemetry and on the username matching the UDM principal.user.userid format. Very broad process name filters may also reduce precision of the natural language query translation.

Related Skills

Explore More Software Engineering Skills→
dandyedandye
120

enrich-ioc

Enrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.

Community
Advanced
wgpsecwgpsec
1.7k

emergency-response

Investigate compromised Linux and Windows hosts through account, process, persistence, and log analysis.

Official
Advanced
NY1024NY1024
25

clawguard-threat-detect

Detect and block runtime security threats in OpenClaw agent environments.

Community
Advanced
OpenTideHQOpenTideHQ
4

google-cloud-platform

Interpret GCP Cloud Audit Logs and IAM mechanics for abuse detection.

Official
Advanced