How to use the Detection Coverage Evaluation agent skill

What this skill makes the agent do

An agent skill is a folder with instructions (a SKILL.md file and any reference files) that an AI agent reads when a task matches the skill's description. This skill teaches the agent to run a detection engineering workflow in Google SecOps, a security analytics platform, through its MCP tools.

Given a threat intelligence article or pasted text, the agent identifies attacker techniques as Threat Detection Opportunities (TDOs), generates simulated attack log events, checks whether your existing detection rules would catch those events, and proposes new rules only for gaps. It asks you before creating anything in your environment.

• Reads a blog URL or raw text you paste in
• Turns the report into one or more Threat Detection Opportunities
• Generates synthetic UDM events that simulate each technique
• Evaluates which existing rules match those events, one TDO at a time
• Drafts new rules only for TDOs with zero matching rules
• Summarises findings and gaps, then asks for approval before adding rules

Check what you need before installing

This skill cannot run without its platform. The source lists three requirements: a Google SecOps instance with MCP tools available, gcloud and REST API access as described in the attribution reference file, and web fetching capability if you want to give it URLs.

The skill does not run scripts, but it does use the network, because it fetches web pages and calls Google SecOps and Google Cloud APIs.

• A Google SecOps instance with MCP tools available to the agent
• gcloud and REST API access, as described in references/attribution.md
• Web fetching capability for URL inputs (not needed if you paste text)

Install the skill in Claude

You can install the skill as a folder on your machine or upload it through the Claude apps. Download the ZIP from the skill's page on this site first.

For a personal install, unzip the download into your ~/.claude/skills/ folder. For a single project, unzip it into that project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside the project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Ask for it with natural requests

You do not need a special command. The agent picks up the skill when your request matches its description, which covers fetching threat intelligence, generating TDOs, simulating attacker behaviour with synthetic UDM events, evaluating rule coverage, and deploying gap-closing rules.

Name the source and the goal. Say what you want measured, such as coverage against a specific report, and make clear you want the rules checked rather than written from scratch.

• Check our Google SecOps rules against this threat report: https://example.com/article
• Generate TDOs from the text I paste below and tell me which ones have no matching rules
• Evaluate detection coverage for the techniques in this report and propose rules only for the gaps
• Simulate the attacker behaviour in this article and see whether our existing rules would catch it

Understand the workflow the agent follows

The skill is a checklist of eight steps. The agent reports a short summary after each step instead of dumping raw output, so you can follow along.

First it extracts clean article text, removing navigation, footers and similar page elements. Then it generates TDOs and, for each TDO, synthetic events. It runs coverage evaluation for each TDO as a separate long-running operation and polls until all are finished. It then fetches details for rules that matched and drafts new rules only where no rule matched. The final step is a summary of findings and gaps, followed by a request for your approval to create the new rules.

• Step 1: Extract the text from the source
• Step 2: Generate Threat Detection Opportunities
• Step 3: Generate synthetic events for all TDOs
• Step 4: Evaluate rule coverage for each TDO and poll until done
• Step 5: Fetch details for matched rules
• Step 6: Generate new rules only for TDOs with zero matching rules
• Step 7: Summarise findings and gaps
• Step 8: Ask you to approve adding new rules to your environment

Safety notes to read before you run it

The skill tells the agent to check extracted web text for common prompt injection phrases, such as attempts to ignore earlier instructions or reveal the system prompt. If it finds one, it halts the workflow and logs a security warning.

Every gcloud command the agent runs must be tagged with a metrics environment variable that identifies the skill and its version. The tag is set inline on each command and must not be saved with gcloud config set. The tag contains no user data.

The agent must not create rules in your environment without your approval in Step 8. Review the summary before you say yes.

• Prompt injection check runs on fetched web text before any further steps
• Scripts: none are included in this skill
• Network: used to fetch web pages and call Google SecOps and Google Cloud APIs
• gcloud commands are tagged inline only, with no persistent configuration change
• Rule creation requires your explicit approval

Tips for better results

Give the agent the full article or text where you can. The skill is designed to pass the full text to TDO generation and says the agent must not summarise it first. Pasting text avoids depending on web fetching.

Keep each run focused on one report. The workflow handles several TDOs in one run, but a single article keeps the summary easy to review. Also remember the skill is not for YARA-L rule writing or tuning, which the description routes to the secops-detection-engineering skill, and not for threat hunting or live SOC investigations.

• Paste the full text if web fetching is unavailable or the page is hard to read
• Use one article per run to keep the gap summary easy to review
• For writing or tuning YARA-L 2.0 rules, use the secops-detection-engineering skill instead