secops-detection-engineering
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection...
What this skill does for you
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep forensic event reconstruction on infected hosts (use secops-investigate), or case management operations (use secops-cases).
Quoted from the skill description in the pinned sourceWho made it
Use it with Edge
Set up Edge for me: read getedge.cc/SKILL.md and follow it. Then use Edge to load the secops-detection-engineering skill from google/skills.
Paste it into Claude, ChatGPT, Codex or Cursor.
Or read the skill source first.
Security evidence
| Scanner | Date | Result | Findings |
|---|---|---|---|
| Edge static checks | 2026-09-27 | Pass | 0 |
| Cisco skill-scanner | 2026-09-27 | Pass | 0 |
| Semgrep Edge rules | 2026-09-27 | Pass | 0 |
Static scans check the code, not how well the skill works.
Scanner scope, raw findings and mirrored provider records
Edge static checks (Edge-run): edge-static/1.0.1. Scope: Static patterns for remote execution, credentials with network sends, obfuscation, prompt overrides, hidden Unicode, binaries and persistence. Revision: f566651a2f60aecbc4654f8868fb239f85a783f6. Raw findings: . Counted findings: .
Cisco skill-scanner (Edge-run): cisco-skill-scanner/2.1.0. Scope: Local static, YARA, pipeline and behavioral analyzers; no LLM or AI Defense analysis. Revision: f566651a2f60aecbc4654f8868fb239f85a783f6. Raw findings: 1. Counted findings: .
Semgrep Edge rules (Edge-run): semgrep/1.178.0+edge-rules.c15016a36fd3+offline-v1. Scope: Six Edge-authored static rules with Semgrep CE; offline execution and metrics disabled. Semgrep-maintained rules excluded. Revision: f566651a2f60aecbc4654f8868fb239f85a783f6. Raw findings: . Counted findings: .
Source and licence
- Repository
- https://github.com/google/skills
- Pinned skill file
- View source at revision
- Revision
- f566651a2f60aecbc4654f8868fb239f85a783f6
- Package hash
- sha256:8ea187405383cf2d44c5df1410495f870f28e3693b087e32ce4c65ff6c924e38
- Licence
- Apache-2.0