detection-engineering-coverage-evaluation

detection-engineering-coverage-evaluation automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. It is defensive security tooling: it helps blue teams turn threat intelligence into measurable detection coverage, closing the gap between reading about a new attacker technique and confirming whether existing SecOps rules would catch it. It explicitly scopes itself away from threat hunting and SOC investigative actions.

The skill runs a tracked eight-step lifecycle. It extracts and cleans threat-intel text from a blog URL or raw input — and, notably, includes a defensive prompt-injection check that halts the workflow and logs a warning if the fetched content tries to override instructions. It then generates Threat Detection Opportunities (TDOs) via generate_threat_detection_opportunity, loops over every TDO to produce synthetic UDM events (simulating attacker behaviors purely as test data), evaluates each event against existing rules with evaluate_rule_coverage, audits matched rules' enablement and alerting status with get_rule, generates new YARA-L 2.0 rules for coverage gaps, and presents a structured summary. Crucially, deployment is gated: newly generated rules are only added to the user's SecOps environment via create_rule after explicit per-rule user approval. Throughout, the skill instructs the agent to report counts and summaries rather than dumping full raw text, TDO JSON, or coverage output.

It targets detection engineers and security teams operating Google SecOps who want repeatable, auditable coverage evaluation and gap remediation driven by fresh threat intelligence.