Evaluate threat coverage with the Detection Engineering Agent

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google SecOps Technical Support Service guidelines and the Google SecOps Service Specific Terms.

This guide is for security engineers and SOC analysts who want to evaluate and strengthen their Google Security Operations security posture against new and existing threats, using the Detection Engineering Agent. The Detection Engineering Agent is an AI-powered engineering assistant, which is part of Google SecOps. The agent is accessible using Model Context Protocol (MCP) tools operated by compatible AI clients (for example, Google Antigravity or Claude Code). Using the Detection Engineering Agent, you can extract threat intelligence and automatically draft YARA-L rules, which improves time-to-value for custom security automation and improves risk mitigation.

This AI-powered assistant helps you extract threat intelligence and automatically draft YARA-L detection rules, improve time-to-value for custom security automation, and accelerate risk mitigation.

Key terminology

• Detection Engineering Agent: An AI-powered engineering assistant embedded in Google SecOps, operated by AI clients (for example, AntiGravity or Claude Code) using MCP tools.
• Model Context Protocol (MCP): An open-source standard for connecting AI applications to external systems, which is used across Google Cloud services to securely connect AI agents and applications to various data sources and infrastructure tools.
• Threat Detection Opportunity (TDO): A formalized data model designed to identify, track, and prioritize potential new detection rules or analytics.
• Synthetic events: Unified Data Model (UDM) logs generated to simulate an input TDO.

Before you begin

Before you begin, confirm the following prerequisites are met:

• Permissions: Every principal calling the Detection Engineering Agent must have the following roles: MCP Tool User and Chronicle API Viewer. Ensure that a system administrator updates these roles for all principal users. For additional guidance, refer to the Google SecOps MCP documentation.
• Environment check: You must operate an AI client (such as Antigravity or Claude Code) capable of interfacing with MCP tools.

Set up the MCP server

Refer to the MCP server configuration guidance to create your settings.json. Once you have everything collected, ensure that the contents of your settings.json file looks like the following:

{
  "name": "my_extension_name",
  "version": "1.0.0",
  "mcpServers": {
    "GoogleSecOps": {
      "httpUrl": "https://chronicle.us.rep.googleapis.com/mcp",
      "authProviderType": "google_credentials",
      "oauth": {
        "scopes": [
          "https://www.googleapis.com/auth/cloud-platform",
          "https://www.googleapis.com/auth/chronicle"
        ]
      },
      "timeout": 300000,
      "headers": {
        "x-goog-user-project": "my-cloud-project-name"
      }
    }
  }
}

Set up a context file

To get started, you need to set up a context file to ensure that Gemini targets the correct Google SecOps instance for every request.

To keep everything lightweight, Google recommends starting with the following content in your Gemini.md file and then building from there. Update with the correct information for your Google SecOps instance and environment:

When using the Google SecOps MCP server, use these parameters for EVERY request: Customer ID: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa Region: us Project ID: my-cloud-project-name

Set up the skill to interact with the tools

Google highly recommends using the detection-engineering-coverage-evaluation skill to interact with the tools. This skill prevents the AI from summarizing or abbreviating critical tool outputs.

This skill is built-in as detection-engineering-coverage-evaluation and is hosted publicly in the Google Agent Skills GitHub repository.

Caution: Gemini may try to take shortcuts (such as summarizing tool output or overzealously compacting the TDO). Using the detection-engineering-coverage-evaluation skill enforces proper iterative execution.

Key capabilities

This section describes key capabilities for threat analysis and rule generation that the Detection Engineering Agent provides.

Generate Threat Detection Opportunities

The generate_threat_detection_opportunity tool extracts and enriches raw threat intelligence from sources (for example, security blogs and internal findings) to create prioritized TDOs for analysis. The TDOs produced in this step inform the subsequent detection engineering agent steps to evaluate existing rule coverage or generate new rules.

• To use the generate_threat_detection_opportunity tool, instruct Gemini to use curl to extract the text, or you can copy and paste raw text from a threat report into the tool.

Generate synthetic events

The Detection Engineering Agent generates User Data Model (UDM) logs that simulate an input TDO.

Evaluate coverage

Checks whether existing rules in your Google SecOps instance trigger on simulated events ingested through event simulation. If any rules match the simulated events, the tool returns the matching rule identifiers and coverage result metadata. If no rules match, an empty result is returned, signaling a coverage gap.

Generate draft rules

Codifies detection logic by creating draft YARA-L rules from user input or natural language to address gaps identified during coverage evaluation. This tool does not automatically upload the rule into your Google SecOps system. In order to add any rule, review the text and then manually create new rules from the tool output.

Troubleshooting

This section outlines performance expectations and provides self-service fixes for common issues during the evaluation process.

Latency and limits

Ensure your system has available parsers for the logs associated with your input TDOs; otherwise, synthetic event generation will fail.

Error remediation

Use this table to quickly self-remediate deployment issues:

Issue	Description	Fix
Tool failure	The synthetic event generation tool repeatedly fails.	Check the supplied TDO and ensure your environment has a parser for at least one of the input log types. If not, your system might not have coverage for this specific TDO as evaluated by the system. Continue the flow with other TDOs output by the first tool.
Summarization error	The AI abbreviates log types or takes shortcuts during execution.	Ensure the detection-engineering-coverage-evaluation skill is actively being used to interface with the system.

Need more help? Get answers from Community members and Google SecOps professionals.