domains / families / security / detection-engineering-coverage-evaluation

detection-engineering-coverage-evaluation

separate

Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating Threat Detection Opportunities (TDOs), simulating attacker behavior with synthetic UDM events, evaluating rule coverage, and deploying gap-closing rules. Don't use for standalone YARA-L 2.0 rule authoring/tuning (use secops-detection-engineering), threat hunting, or SOC investigation.

When to use

• fetching threat intelligence from blogs
• generating Threat Detection Opportunities (TDOs)
• simulating attacker behavior with synthetic UDM events
• evaluating rule coverage
• deploying gap-closing rules

When not to use

• standalone YARA-L 2.0 rule authoring/tuning
• threat hunting
• SOC investigation

Skill page

Source