google-secops

Unified Detection-as-Code engine for Google SecOps and beyond.

Autonomous, read-only threat-hunting platform for SOC analysts: an LLM agent turns a hypothesis into sourced IOCs, hunts across Microsoft Sentinel, Defender and Google SecOps under human checkpoints, and delivers an investigation report.

Agent Skill for writing, reviewing, tuning, and converting Google SecOps YARA-L 2.0 detection rules, with an offline linter

An autometed sniffer and parser designed to send packets captured by Wireshark to Google Chronicle.

Collection of YARA-L 2.0 sample rules for the Chronicle Detection API

Chronicle Content Marketplace

KC7-inspired Google SecOps SIEM Search training; no runtime AI or workplace data

A port of Google SecOps Hosted MCP to Agent Skills

Feed monitoring system for Google SecOps

A Python script that can bulk close Google SecOps SOAR cases.

This is an MCP (Model Context Protocol) server for interacting with Google's Chronicle Security Operations API.

Python samples and utilities for Chronicle APIs

Central Fleet Management Console & Observability Control Plane for LegacyTel. Features a real-time glassmorphic security log auditor, network topology mapping, OTLP log ingestion, dynamic agent upgrades, and automated hot-swap/rollback policy orchestration.

One ClickFix attack, three rule formats, two SIEMs: Sigma, Elastic KQL/EQL, and Google SecOps YARA-L detections for T1204.004