secops-detection-engineering
secops-detection-engineering is an agent skill published by google, listed under deploy & operate. It lives in the google/skills repository, which has 21,580 GitHub stars and is licensed under Apache-2.0; we last read it on 2026-10-23.
This repository contains tools and scripts for authoring, validating, testing, and deploying YARA-L 2.0 detection rules, and evaluating end-to-end detection coverage in Google SecOps. It requires credentials for accessing SecOps systems and threat intelligence sources.
Install
skills is a generic installer for any repository of Claude agent skills -- it reads google/skills’s own structure rather than assuming one, the same way this page reads the skill’s own SKILL.md rather than assuming a format.
npx skills add google/skills
Maintenance
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep forensic event reconstruction on infected hosts (use secops-investigate), or case management operations (use secops-cases).
secops-detection-engineering compared with similar skills
| Skill | Publisher | What it does | Repo stars | Last update |
|---|---|---|---|---|
| secops-detection-engineering (this page) | Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps… | 21,580 | 2026-10-25 | |
| agent-platform-endpoint-management(same repository) | Manages Agent Platform serving endpoints. Use when you need to create, list, describe, update, or delete serv… | 21,580 | 2026-10-25 | |
| agent-platform-model-registry(same repository) | Agent Platform Model Registry Management. Use when you need to upload, list, describe, update, or delete mach… | 21,580 | 2026-10-25 | |
| application-design-center-design-deploy(same repository) | Processes GCP infrastructure design and deployment workflows within Application Design Center (ADC). Use when… | 21,580 | 2026-10-25 | |
| cloud-build-basics(same repository) | Teaches the fundamentals of Cloud Build on Google Cloud. Covers core concepts, API enablement, console naviga… | 21,580 | 2026-10-25 | |
| cloud-monitoring-chart-generation(same repository) | Generates Cloud Monitoring Server-Driven UI (SDUI) Widget and XyChart Protocol Buffer textprotos on Google Cl… | 21,580 | 2026-10-25 | |
| cloud-monitoring-metric-selection(same repository) | Retrieve, query, and identify relevant Cloud Monitoring metric descriptors on Google Cloud for a service or r… | 21,580 | 2026-10-25 |
Skills from the same repository first, then others for this job by repository stars. Figures are from each repository when we last read it.
Common questions about secops-detection-engineering
- What does secops-detection-engineering do?
- This repository contains tools and scripts for authoring, validating, testing, and deploying YARA-L 2.0 detection rules, and evaluating end-to-end detection coverage in Google SecOps. It requires credentials for accessing SecOps systems and threat intelligence sources.
- How do I install secops-detection-engineering?
- Run npx skills add google/skills. The skills installer reads the repository’s own structure, so it works for any repository of agent skills.
- Who publishes secops-detection-engineering?
- google.
- Is secops-detection-engineering maintained, and what licence does it use?
- Its repository has 21,580 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-10-25. The repository declares the Apache-2.0 licence.
More agent skills for deploy & operate
- ai-content-pipelineby 101-skills
- explainer-video-guideby 101-skills
- ci-cd-and-automationby addyosmani
- observability-and-instrumentationby addyosmani
- internal-commsby anthropic
- xlsxby anthropic