Overview
What It Does
Detection Engineering Coverage Evaluation packages a focused devops & cloud workflow for an AI agent. Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating Threat Detection Opportunities (TDOs), simulating attacker behavior with synthetic UDM events, evaluating rule coverage, generating new YARA-L 2.0 rules to close coverage gaps, and with user approval, deploy them to SecOps. Don't use when asked to perform threat hunting actions, and SOC investigative actions. It is best suited to users who can review the resulting actions and provide only the accounts, files, or command access needed for the task. It is not a substitute for human approval on destructive, financial, security-sensitive, or public-facing actions.
Task ideas
Popular Use Cases
- Inspect deployment or infrastructure state
- Automate a repeatable operations task
- Troubleshoot configuration and runtime issues
- Apply documented production practices
Installation
Install this Agent Skill
Claude Code
npx skills add https://github.com/google/skills --skill detection-engineering-coverage-evaluationCommands derived from the public GitHub SKILL.md record. Checked 2026-09-02. Review the source before running them.
Before you start
Requirements
| Claude Code | Required / review |
| Codex | Required / review |
| Public SKILL.md source | Required / review |
| Review instructions and requested permissions before installation | Required / review |
| Paid service | Check source |
| Supported system | Check source |
Popularity context
Why It’s Popular
Detection Engineering Coverage Evaluation is a verified Agent Skill from google with a public SKILL.md, compatible with Claude Code, Codex, Gemini CLI.
Alternatives
