An agent skill that teaches AI coding agents to write review tune and convert YARA-L 2.0 detection rules for Google Security Operations SecOps formerly Chronicle. The skill works with Claude Code Claude.ai GitHub Copilot OpenAI Codex Gemini CLI Cursor and any client that reads the SKILL.md format.

How the skill works

Give your agent a threat description an ATT&CK technique a Sigma rule or an SPL/KQL query. It returns:

  • A one sentence statement of the detection logic
  • A complete YARA-L 2.0 rule with full meta outcome and $risk_score
  • A list of UDM fields to verify against your parser
  • The reference lists and data tables to create with sample rows
  • A should fire test and a should not fire test
  • The two most likely false positive sources and how to tune them out

The skill also ships an offline linter that catches the mistakes the Rules Editor would reject. Run the linter with:

python3 skills/yara-l-authoring/scripts/lint_rule.py my_rule.yaral



It checks:



    

  • Section order and required sections
    • 

  • metadata.event_type values against the UDM enum
    • 

  • Integer fields compared to quoted strings
    • 

  • Event variables that never join to a match placeholder
    • 

  • Outcome fields missing an aggregate in rules with match
    • 

  • Absence conditions without a match section
    • 

  • Regex patterns that start with .*
    • 

  • Missing meta keys and $risk_score
    • 




A clean lint result does not mean the rule compiles. Always validate in the SecOps Rules Editor or through the SecOps API before enabling a rule.



Example commands and usage



    

  • Write a YARA-L rule for 10 failed logins followed by a success within 30 minutes
    • 

  • Convert this Sigma rule to YARA-L: <paste>
    • 

  • Review this YARA-L rule for performance and false positives: <paste>
    • 

  • Detect OAuth device code sign ins from Entra ID for users outside an approved list
    • 




Copy the skills/yara-l-authoring folder to your agents skill directory:





AgentPersonalProject


Claude Code~/.claude/skills/.claude/skills/


GitHub Copilot / VS Code~/.copilot/skills/.github/skills/


Codex and other clients~/.agents/skills/.agents/skills/





Install via git:



git clone https://github.com/ajaynyayapathi/yara-l-skill.git
cp -r yara-l-skill/skills/yara-l-authoring ~/.claude/skills/



For Claude.ai zip the yara-l-authoring folder and upload it as a custom skill.



Skill structure



The yara-l-authoring folder contains:



    

  • SKILL.md Instructions the agent loads
    • 

  • references/ syntax.md Sections operators functions lists data tables udm-fields.md High use UDM fields by detection category tuning-checklist.md Pre submit review for performance and false positives
    • 

  • examples/ 01_single_event_certutil_download.yaral 02_sequence_bruteforce_then_success.yaral 03_absence_edr_sensor_offline.yaral 04_data_table_device_code_signin.yaral
    • 

  • scripts/ lint_rule.py Offline structural linter Python 3 no dependencies
    • 




Linter checks and guidelines



The linter checks section order required sections metadata.event_type values against the UDM enum integer fields compared to quoted strings event variables that never join to a match placeholder outcome fields missing an aggregate in rules with match absence conditions without a match section regex patterns that start with . missing meta keys and $risk_score



UDM field population varies by parser. Rules mark uncertain fields with // VERIFY: . Example rules use placeholder product names and table names. Replace them before you deploy. New rules should run with alerting off for 7 days while you review detection volume.



Pull requests welcome for new example rules UDM field corrections and linter checks. Each new example needs a should fire and a should not fire case in its header comment and must pass the linter.



MIT. See LICENSE.



YARA-L Google Security Operations and Chronicle are trademarks of Google LLC. This project is not affiliated with or endorsed by Google.