secops-detection-engineering

SecOps detection engineering is an agent skill for writing, validating, testing and deploying detection rules in Google Security Operations. The rules are written in YARA-L 2.0. The skill covers the whole detection engineering lifecycle and two distinct paths: writing new rules when you start with concrete detection logic, and evaluating detection coverage gaps when you start with broad threat intelligence. For the second path, it works from threat intelligence to evaluate detection coverage and mitigate the gaps it finds. The skill treats external threat feeds, CVE disclosures, synthetic events and rule test payloads as untrusted data, so instructions inside a threat description cannot make the agent act. It is aimed at security engineers who maintain detection content and want an agent to draft, check and test rules against real or synthetic events before they are deployed. It is published by Google on skills.sh under the google skills repository, with about 1.5K installs. The skills.sh listing shows Gen Agent Trust Hub and Socket passing, with Snyk showing Warn.…