Chronicle (GCP) Detection Rules
A collection of example YARA-L detection rules and dashboards for Google Security Operations (SecOps).
What is Chronicle (GCP) Detection Rules?
Google Security Operations Detection Rules is an open-source repository of example YARA-L rules and dashboard templates for Google Security Operations (SecOps). It provides security teams with community-contributed detection logic and visualization tools to identify threats, monitor security events, and customize their security operations workflows within the Google Cloud ecosystem.
Security analysts, threat hunters, and DevOps engineers using Google Security Operations who need to implement custom detection rules, build dashboards, or automate security monitoring pipelines.
It offers practical, ready-to-use examples that complement Google's proprietary detections, enabling teams to accelerate their SecOps deployments, learn YARA-L best practices, and adopt a Detection-as-Code approach through included tooling and community contributions.
Overview
Collection of example YARA-L rules for use within Google Security Operations
Use Cases
Best For
- Implementing custom threat detection rules in Google SecOps
- Building security dashboards for incident visualization
- Learning YARA-L syntax and rule authoring best practices
- Automating rule management via REST API pipelines
- Enhancing security monitoring with community-driven detections
- Creating templated dashboards for security reporting
Not Ideal For
- Teams using SIEM platforms other than Google SecOps, such as Splunk or Elastic Stack
- Organizations seeking fully supported, out-of-the-box detections without tuning or customization
- Projects requiring sophisticated rule lifecycle management with native integration into third-party DevOps tools beyond the provided CLI
- Security teams without access to Google SecOps or its REST API for automation
Pros & Cons
Pros
The repository includes YARA-L rules created by Google SecOps team and the user community, offering diverse examples for threat detection and fostering collaboration.
Sample YAML dashboards can be imported directly into Google SecOps via the UI, serving as customizable starting points for security visualization.
Includes a CLI tool (content_manager) for managing rules via Google SecOps' REST API, enabling pipeline automation and CI/CD integration.
Promotes testing rules before deployment using Google SecOps' test functionality, allowing tuning for specific environments to reduce false positives.
Cons
Rules and dashboards are tightly coupled with Google SecOps, making them incompatible with other security platforms without significant rework.
As example rules, they may lack the polish and actionability of Google's proprietary Curated Detections, which are designed for enterprise use.
The CLI tool requires familiarity with Google SecOps' REST API and may have a learning curve for teams new to Detection-as-Code workflows.
Frequently Asked Questions
Related Projects
Sigma RulesMain Sigma Rule Repository
Elastic Detection RulesDetection Rules is the official repository for the rules used by Elastic Security's Detection Engine. It provides a comprehensive toolkit for security teams to develop, validate, test, and release detection logic in a structured, code-driven manner. This approach enables version control, automated testing, and streamlined integration with the Elastic SIEM. ## Key Features - **Rule Development & Management** — Python module for parsing, validating, and packaging detection rules from TOML files. - **Detections as Code (DaC)** — Full pipeline and CLI tools to manage rules with version control and automated workflows. - **Unit Testing Framework** — Integrated Python testing suite to validate rule logic and ensure reliability. - **Kibana Integration** — Library for API calls to Kibana and the Detection Engine for seamless rule deployment. - **KQL Validation** — Library for parsing and validating Kibana Query Language used in rule conditions. - **Threat Hunting Packages** — Dedicated directory for storing and managing threat hunting queries and packages. ## Philosophy The project embraces a Detections-as-Code philosophy, treating security rules as software artifacts to improve maintainability, collaboration, and automation in threat detection.
KQL Advanced Hunting Queries & Analytics RulesKQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Splunk Security ContentSplunk Security Content
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.