Skill Claude CodeCodex
Use when creating, testing, deploying, or managing Google SecOps detection rules — the detection engineering workflow, retrohunts, rule quotas, detection delays, context-aware analytics (entity graph in rules), risk scoring, error troubleshooting, performance optimization, or composite detections. Complements…
Skill Claude CodeCodex
Use when writing or running Google Security Operations (SecOps/Chronicle) SIEM queries or investigations — UDM filter queries, stats/aggregation, event-event joins, raw log search, reference list lookups, entity investigations (users, hosts, IPs, files, domains), enriched data queries (geolocation, VirusTotal), entity…
Skill Claude CodeCodex
Use when writing YARA-L 2.0 detection rules or complex search queries for Google SecOps — single-event rules, multi-event correlation, sliding window detections, composite rules, outcome aggregations, conditional logic, multi-stage queries, or any YARA-L syntax questions. Triggers: "write a detection rule", "create a…