--- title: "SecOps Detection Coverage Skill - Air Market" description: "You read about a new attacker technique and want to know whether your detections would catch it. This takes the writeup, works out what should be detected, tries the behavior against your rules, and…" canonical: "https://airmarket.ai/app/detection-engineering-coverage-evaluation" --- [Air Market](/) / [Security](/category/security) / SecOps Detection Coverage Skill Skill by [Google](/@google) # SecOps Detection Coverage Skill Turn a threat writeup into detection rules that are actually covered ## What this does You read about a new attacker technique and want to know whether your detections would catch it. This takes the writeup, works out what should be detected, tries the behavior against your rules, and writes new ones where nothing fires. Nothing gets deployed until you say so. Reach for it when you are building or checking detection coverage. ### Top 3 things it does for you - Pull threat intel out of a blog post - Find out whether my rules would catch this behavior - Write new rules to close the gaps I find ## Information **SecOps Detection Coverage Skill at a glance** | | | | --- | --- | | Kind | Skill | | Publisher | [Google](/@google) | | Category | [Security](/category/security) | | Works with | Agent Skills - an open standard supported by 40+ agents | | Size | 13 KB | | Licence | Apache-2.0 | | Repository | [google/skills](https://github.com/google/skills/tree/ab92ce11c57f7c587c982e72c96112ff29547274/skills/cloud/detection-engineering-coverage-evaluation) | | GitHub stars | 18,649 (as of Nov 2026) | | Installs | 7,374, counted by skills.sh (Nov 2026) | ## Security report **Verified.** AIR scanned this exact version of SecOps Detection Coverage Skill and flagged nothing. AIR's verdict: **safe**. **What SecOps Detection Coverage Skill's check was run against** | | | | --- | --- | | Commit | ab92ce11c57f7c587c982e72c96112ff29547274 | | Content hash | 15a821a6ee2b201100fabfbb54d0eac271ff1b5b1480a9f5c3678271e6f6caf7 | | Files read | [Browse the files at this exact commit](https://github.com/google/skills/blob/ab92ce11c57f7c587c982e72c96112ff29547274/skills/cloud/detection-engineering-coverage-evaluation/SKILL.md) | A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned. [Read the full security report for SecOps Detection Coverage Skill](/security/detection-engineering-coverage-evaluation) ## About SecOps Detection Coverage Skill This runs the detection engineering workflow in Google SecOps end to end. It starts from threat intelligence gathered from blogs, turns that into Threat Detection Opportunities, and simulates attacker behavior with synthetic UDM events so rule coverage can be evaluated against something concrete. Where coverage is missing, it generates new YARA-L rules to close the gap, and deploys them to SecOps with your approval. It is not for threat hunting or for SOC investigative work. ## What's inside - SKILL.md - instructions ## Questions ### Is SecOps Detection Coverage Skill safe to install? AIR scanned this exact version of SecOps Detection Coverage Skill and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit ab92ce11c57f, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/detection-engineering-coverage-evaluation. ### How do I install SecOps Detection Coverage Skill? Open https://airmarket.ai/app/detection-engineering-coverage-evaluation on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/google/skills/tree/ab92ce11c57f7c587c982e72c96112ff29547274/skills/cloud/detection-engineering-coverage-evaluation. Install from that link, not the branch. ## Related on Air Market - [More Security listings](/category/security) - [Everything by Google](/@google) --- Canonical URL: