Find gaps in your Google SecOps threat rules.
What it does
Evaluates Google SecOps detection coverage against threat intelligence and proposes rules for confirmed gaps.
When to use it
Use for threat-intelligence-driven coverage evaluation, synthetic attacker events, and gap-closing rule deployment, not standalone rule authoring, threat hunting, or SOC investigation.
How to use it
Give it a threat intelligence URL or text; it returns coverage findings and proposed gap-closing rules, then asks approval before deployment.
What you provide
- a threat intelligence URL or text
Uses
What you need · 2
Requires a configured SecOps MCP server to use the detection workflow tools and create approved rules.
Requires an existing SecOps environment whose detection rules can be evaluated and supplemented with approved rules.
Access · 2
This skill
Google SecOps
Starts detection coverage jobs
Sends threat data and adds rules
threat intelligence URLs
Fetches threat intelligence articles