Detection Engineering Coverage Evaluation skill: what it does and how to install it

What it does. Extracts threat intelligence from a URL or supplied text, generates Threat Detection Opportunities and synthetic UDM events, then checks existing rules for coverage. It summarises matching rules and gaps, generates rules for uncovered threats, and can create approved rules in Google SecOps.

When to use it. For an end-to-end detection coverage evaluation in Google SecOps. It is not for standalone YARA-L 2.0 rule authoring or tuning, threat hunting, or SOC investigations.