A collection of example YARA-L detection rules and dashboards for Google Security Operations (SecOps).
Google Security Operations Detection Rules is an open-source repository of example YARA-L rules and dashboard templates for Google Security Operations (SecOps). It provides security teams with community-contributed detection logic and visualization tools to identify threats, monitor security events, and customize their security operations workflows within the Google Cloud ecosystem.
Security analysts, threat hunters, and DevOps engineers using Google Security Operations who need to implement custom detection rules, build dashboards, or automate security monitoring pipelines.
It offers practical, ready-to-use examples that complement Google's proprietary detections, enabling teams to accelerate their SecOps deployments, learn YARA-L best practices, and adopt a Detection-as-Code approach through included tooling and community contributions.
Collection of example YARA-L rules for use within Google Security Operations
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The repository includes YARA-L rules created by Google SecOps team and the user community, offering diverse examples for threat detection and fostering collaboration.
Sample YAML dashboards can be imported directly into Google SecOps via the UI, serving as customizable starting points for security visualization.
Includes a CLI tool (content_manager) for managing rules via Google SecOps' REST API, enabling pipeline automation and CI/CD integration.
Promotes testing rules before deployment using Google SecOps' test functionality, allowing tuning for specific environments to reduce false positives.
Rules and dashboards are tightly coupled with Google SecOps, making them incompatible with other security platforms without significant rework.
As example rules, they may lack the polish and actionability of Google's proprietary Curated Detections, which are designed for enterprise use.
The CLI tool requires familiarity with Google SecOps' REST API and may have a learning curve for teams new to Detection-as-Code workflows.