llms.txt git:20260416.fb36fa7A

Immutable. This exact content never changes and is served at /api/v1/blob/798655c5b5cb47f0.

# SecOps Skills

A collection of Agent Skills for Google Security Operations (SecOps/Chronicle) SIEM —
covering search queries, YARA-L detection rules, and detection engineering workflows.

## Skills

- [SecOps SIEM Search](skills/secops-siem-search/SKILL.md): Write and run Google SecOps SIEM queries — UDM filter queries, stats/aggregation, event-event joins, raw log search, reference list lookups, entity investigations, enriched data queries, and entity context search.
- [SecOps YARA-L](skills/secops-yara-l/SKILL.md): Core language reference for YARA-L 2.0 — syntax, functions, operators, and foundational overviews used for both search and rules.
- [SecOps Detection Engineering](skills/secops-detection-engineering/SKILL.md): Create, test, deploy, and manage Google SecOps detection rules — rule building guides, multi-event correlation, best practices, and detection workflows.


## Reference Files

- [Log Types — Full List](skills/secops-siem-search/references/all-log-types.md): All 1000+ supported `metadata.log_type` values.
- [UDM Fields](skills/secops-siem-search/references/udm-fields.md): Full UDM schema, event types, and high-performance filter fields.
- [YARA-L Cheat Sheet](skills/secops-yara-l/references/cheat-sheet.md): Quick syntax reference for all YARA-L constructs.
- [Live Documentation Sources](skills/secops-siem-search/references/docs.md): URL map for official Google SecOps documentation with fetch and refresh instructions.

## Community Resources & Feeds (Best Practices)

- [That SIEM Guy](https://medium.com/feed/@thatsiemguy): RSS feed for That SIEM Guy blog (Best practices).
- [b.sim619](https://medium.com/feed/@b.sim619): RSS feed for b.sim619 blog (Best practices).
- [grku](https://medium.com/feed/@grku): RSS feed for grku blog (Best practices).