SecOps Detection Coverage Skill

Routing Note: To author, test (Retrohunt), or tune YARA-L 2.0 detection rules directly, open secops-detection-engineering/SKILL.md.

This skill guides the agent through an end-to-end detection engineering lifecycle using Google SecOps MCP tools. It handles multiple Threat Detection Opportunities (TDOs) and ensures exhaustive coverage evaluation for all generated synthetic events.

Usage Attribution

MUST READ: Before executing any gcloud, REST API, or MCP command, you MUST read and follow the instructions in Usage Attribution.

Workflow Execution Checklist

Copy this checklist and track progress for each iteration: