Detection Coverage Evaluation
Turns threat intel articles into synthetic attack events and checks Google SecOps rule coverage
- Repository
- google/skills
- Stars
- 21,782
- Licence
- Apache-2.0
- Files
- 2 files
What it does
This skill teaches an AI agent to run a detection engineering workflow in Google SecOps (a security analytics platform) through its MCP tools. The agent fetches a threat intelligence article or takes pasted text, identifies attacker techniques as Threat Detection Opportunities, generates simulated attack log events, checks whether existing detection rules would catch them, and proposes new rules only for gaps, asking the user before creating anything in their environment.
Great for
- Security engineers who want to measure detection coverage against threats described in public reports
- Detection engineering teams that use Google SecOps and its MCP tools
- Teams reviewing whether new threat reports expose gaps in their existing rules
Skip it if
- Writing or tuning standalone YARA-L 2.0 rules; the description routes those to the secops-detection-engineering skill instead
- Threat hunting or live SOC investigations, which this skill explicitly excludes; using it there would mean acting on the wrong workflow
- Users without a Google SecOps environment and MCP tooling, since the workflow cannot run without them
Try asking
- “Evaluate our detection coverage against this blog post about a new phishing campaign: https://example.com/report”
- “Generate threat detection opportunities from the following threat report text and check which ones we already cover”
- “Create synthetic UDM events for the TDOs found in this article and list any coverage gaps”
- “Propose and draft new detection rules for the TDOs that have zero matching rules”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the Apache-2.0 licence and an attribution note.
detection-engineering-coverage-evaluation.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip detection-engineering-coverage-evaluation.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip detection-engineering-coverage-evaluation.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Paste the article text directly if the page is hard to fetch, since the skill then skips URL extraction
- Review the TDO summaries before letting the agent generate events, so you confirm the threats are the ones you care about
- Approve or reject newly generated rules individually at the final step; the skill asks before creating them in your environment
What's inside
- references/attribution.md
- SKILL.md
Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.