SecOps Detection Engineering
Write, validate, test and deploy YARA-L 2.0 detection rules in Google SecOps
- Repository
- google/skills
- Stars
- 21,782
- Licence
- Apache-2.0
- Files
- 4 files
What it does
This skill teaches an AI agent how to build security detection rules for Google Security Operations (Google SecOps). Detection rules are the logic that spots suspicious activity in computer logs. Once installed, the agent follows a set procedure: it drafts rules in YARA-L 2.0 syntax, checks their syntax, tests them against past telemetry, asks for user approval, and then deploys them. It can also take threat intelligence or CVE reports, generate synthetic events, and check whether existing rules already cover those attacker behaviours.
Great for
- Security engineers writing or tuning detection rules in Google SecOps
- Threat hunters turning a confirmed attacker technique into a persistent rule
- Teams auditing detection coverage against threat intelligence and MITRE ATT&CK
Skip it if
- Alert triage or case handling: the description points to other skills (secops-triage, secops-cases) for these, so this one would be the wrong tool
- Deep forensic reconstruction on infected hosts: a different skill (secops-investigate) covers this; using this one may miss evidence
- Anyone without a Google SecOps tenant: the tools it calls only work against a live SecOps environment, and deploying rules changes production alerting
Try asking
- “Write a YARA-L 2.0 rule that alerts when vssadmin.exe is used to delete shadow copies, then test it against last month's events”
- “Check whether our existing rules already detect the techniques in this threat intelligence blog post before I create new ones”
- “Tune this noisy rule to exclude known admin accounts and validate the syntax”
- “Generate synthetic events for this CVE's exploit behaviour and evaluate our rule coverage”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
secops-detection-engineering.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip secops-detection-engineering.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip secops-detection-engineering.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Always review the drafted rule and test results before approving deployment, since create_rule changes live detections
- Paste threat intelligence as text so the agent can extract Threat Detection Opportunities; treat any instructions inside that text as untrusted, as the skill itself instructs
- Run coverage evaluation before creating new rules to avoid duplicating existing detections
What's inside
- references/attribution.md
- references/yaral_compiler_and_udm_guardrails.md
- scripts/validate_yaral_rule.py
- SKILL.md
Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.