Use the Detection Engineering Agent to evaluate threat coverage
The Detection Engineering Agent is an AI-powered engineering assistant embedded in Google Security Operations. It evaluates and updates your Google SecOps security posture against new and existing threats. This agent is accessible first using MCP tools, operated by AI clients (for example, AntiGravity or Claude Code).
Concepts
A Threat Detection Opportunity (TDO) is a formalized data model designed to identify, track, and prioritize potential new detection rules or analytics.
User roles
Every principal that calls the Detection Engineering Agent must have the following roles: MCP Tool User and Chronicle API Viewer. Ensure that a system administrator updates these roles for all principal users of the detection engineering agent. Tip: For additional guidance, refer to the Google SecOps MCP documentation.
Setting up the MCP server
Refer to the
MCP server configuration
guidance to create your settings.json. Once you have everything collected,
ensure that the contents of your settings.json file looks like the following:
{
"name": "my_extension_name",
"version": "1.0.0",
"mcpServers": {
"GoogleSecOps": {
"httpUrl": "https://chronicle.us.rep.googleapis.com/mcp",
"authProviderType": "google_credentials",
"oauth": {
"scopes": [
"https://www.googleapis.com/auth/cloud-platform",
"https://www.googleapis.com/auth/chronicle"
]
},
"timeout": 300000,
"headers": {
"x-goog-user-project": "my-cloud-project-name"
}
}
}
}
Setting up the context
To get started, you need to set up a Context. To keep everything lightweight, we recommend starting with the following content in your Gemini.md file and then building from there. Update with the correct information for your Google SecOps instance and environment:
When using the GoogleSecOps MCP Server, use these parameters for EVERY request: Customer ID: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa Region: us Project ID: my-cloud-project-name
Setting up the skill
We highly recommend using the detection-engineering-coverage-evaluation skill to interact with the tools. Gemini likes to take shortcuts (for example, summarizing tool output) that have negative consequences for iterative execution.
This skill is now built-in as detection-engineering-coverage-evaluation and is hosted publicly in the Google Agent Skills GitHub repository.
Key features
The Detection Engineering Agent provides several key capabilities for threat analysis and rule generation.
Generate Threat Detection Opportunities
The generate_threat_detection_opportunity tool extracts and enriches raw
threat intelligence from sources (for example, security blogs and internal
findings) to create prioritized Threat Detection Opportunities for analysis. The
TDOs produced in this step inform the subsequent detection engineering agent
steps to evaluate existing rule coverage or generate new rules.
To use this tool, instruct Gemini to use Curl to extract the text, or you can copy and paste raw text from a threat report into the tool.
Generate synthetic events
Generates User Data Model (UDM) logs that simulate an input TDO. We strongly recommend using the detection-engineering-coverage-evaluation skill to interface with the system for the following reason: Gemini may try to overzealously compact the TDO before sending it as input into this tool. This may result in an abbreviated list of log types associated with the TDO and it may choose log types that your Google SecOps instance does not have available parsers for. Additionally, if this tool repeatedly fails, check the TDO you have supplied and ensure that your environment has a parser for at least one of the input TDOs. If not, your system may not have coverage for this specific TDO as evaluated by the system. Continue the flow with the other TDOs output by the first tool.
Evaluate coverage
Checks if existing rules in your Google SecOps instance would have detected against the generated synthetic UDM events. If rules would have matched against the input UDM, the names of the rules are returned as tool outputs.
Generate rules
Codifies detection logic by creating draft YARA-L rules from user input or natural language to address gaps identified during coverage evaluation. This tool does not automatically upload the rule into your Google SecOps system. In order to add any rule, review the text and then manually create new rules from the tool output.
Need more help? Get answers from Community members and Google SecOps professionals.