How to use the SecOps Detection Engineering agent skill

What is an agent skill and what does this one do?

An agent skill is a folder with a SKILL.md file that gives an AI agent written procedures for a specific task. When the request matches the skill's description, the agent loads those procedures and follows them.

Once this skill is installed, the agent drafts rules in YARA-L 2.0 syntax, checks their syntax, tests them against past telemetry, asks for your approval, and then deploys them. It can also take threat intelligence or CVE reports, generate synthetic events, and check whether existing rules already cover the attacker behaviours described.

• Direct rule authoring: draft, validate, test against historical data, get approval, deploy.
• Coverage evaluation: extract threat detection opportunities from intel, generate synthetic events, check existing rule coverage, and fill verified gaps.
• Duplicate prevention: test synthetic attack behaviour against the active rule set before creating a new rule.

What you need before you start

This skill only works against a live Google SecOps environment. The tools it calls operate on your tenant, and deploying rules changes production alerting, so confirm access first.

• Google Security Operations (SecOps) tenant access.
• Google SecOps MCP tools (validate_rule, list_rule_detections, create_rule, get_rule, list_rules, evaluate_rule_coverage_long_running, get_operation, generate_rules, generate_threat_detection_opportunity, generate_synthetic_events) or local equivalents.
• gcloud and REST API access for the attribution-tagged commands described in the referenced attribution guide.

Install the skill

Download the ZIP from the skill page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

In the Claude apps you can instead upload the skill under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

How to trigger the skill with natural requests

You do not need a special command. Describe the task in plain language that mentions Google SecOps and detection rules. The skill is meant to trigger for requests about writing new rules, tuning existing ones, validating syntax, testing logic against historical telemetry, and evaluating coverage against threat intelligence, CVEs or Threat Detection Opportunities.

Be specific about the behaviour you want detected. Include the tool, command or indicator if you have one.

• "Write a YARA-L 2.0 rule in Google SecOps that flags certutil.exe downloading remote files, then test it against the last week of telemetry."
• "Check whether our existing rules already cover the attacker behaviour in this vendor blog post before we write anything new."
• "Tune this rule to exclude our backup software's known-good command lines and validate the syntax."

Example workflow: from a finding to a deployed rule

For a known technique, the skill follows the direct authoring path: it drafts the rule, validates syntax with validate_rule, tests against historical telemetry with list_rule_detections, asks you for approval, deploys with create_rule, and confirms the result with get_rule.

For intelligence-driven work, the skill extracts threat detection opportunities, generates synthetic events, runs evaluate_rule_coverage_long_running, polls with get_operation, and fetches matched rules with get_rule. Only verified gaps are mitigated with generate_rules, and again you approve before deployment.

• Read the draft rule and the test results before approving.
• Check that the rule's meta section has the author, description, severity and MITRE ATT&CK technique filled in.

Safety notes: scripts, network and approval

This skill does not run scripts on your machine, but it does use the network, because it calls Google SecOps tools and Google Cloud APIs. Threat intelligence, CVE text and sample payloads are treated as untrusted data, and the skill is told not to follow instructions embedded in them.

Attribution: before any gcloud, REST or MCP command, the agent must follow the usage attribution guide (references/attribution.md). Each gcloud call is prefixed inline with CLOUDSDK_METRICS_REQUEST_ATTRIBUTION set to agent-skills/1.0 (skill:secops-detection-engineering). The guide says not to use gcloud config set for this, so the label does not persist.

• Review every rule before deployment, since deployment changes production alerting.
• Use a test or non-production tenant where possible while you learn the workflow.
• Do not paste sensitive customer data into threat intel or payload inputs unless your policy allows it.

Tips for better results

Give the agent the exact log source, field names or indicators you know. The skill's rule format uses UDM fields such as $e.target.process.command_line, so concrete fields produce more usable rules.

If your task is alert triage, case handling or forensic reconstruction on an infected host, use a different tool. The description points to secops-triage, secops-cases and secops-investigate for those jobs.

• Name the time window you want tested so the historical check is meaningful.
• Ask for tuning when a rule is noisy, rather than starting from scratch.
• Keep the approval step: say yes only after reading the draft and test output.