Community Webinar: Google SecOps Detection Engineering Agent & Antigravity Plugin Overview

Manual context switching across disparate security consoles, threat feeds, and rule editors creates fatigue and leaves critical coverage gaps unaddressed. The Google SecOps Detection Engineering Agent solves this by unifying Google Threat Intelligence (GTI) and Google SecOps UDM telemetry into an integrated, terminal-driven pipeline.

Come join Ivan Ninichuck, Technical Solutions Engineer & Security Advisor at Google Cloud Security, and learn how operating through the Antigravity CLI (agy) and Model Context Protocol (MCP) endpoints enables security engineering teams to structure adversary intelligence into Threat Detection Opportunities (TDOs), map TTPs directly to the MITRE ATT&CK framework, and automate YARA-L 2.0 rule authoring and synthetic testing.

Core Operational Architecture

Threat-Led Discovery & TDO Modeling

• Queries frontline adversary intelligence from Google Threat Intelligence (GTI) via MCP endpoints to extract observed TTPs, campaigns, and actor profiles.
• Formalizes raw threat advisories into machine-evaluable Threat Detection Opportunities (TDOs) mapped directly to MITRE ATT&CK techniques.
• Clusters behaviors into prevalence tiers to construct closed-gap engineering roadmaps based on local tenant telemetry.

Synthetic Simulation & YARA-L 2.0 Authoring

• Generates high-fidelity synthetic UDM events from TDO specifications to evaluate tenant rule coverage safely without triggering production alerts.
• Automates YARA-L 2.0 detection rule drafting, syntax validation, and precision testing for unmitigated coverage gaps.
• Stages validated detection rules locally (dev_rules/) for explicit customer approval before live deployment.

Telemetry Auditing & Log Source Expectations

• Audits active customer log sources against Google SecOps Curated Content Packs to verify rule trigger viability.
• Builds comparative schema matrices between ingested telemetry and expected synthetic events to surface normalization or schema blockers.
• Recommends parser extensions and rule tuning to eliminate orphaned rule evaluations and ensure continuous coverage.

Key Takeaways

Unified Terminal Workflow: Unifies GTI threat intel queries, UDM log validation, and YARA-L 2.0 rule management inside a single CLI environment (agy).

TDO-Driven Integration: Bridges GTI threat analysis and SecOps telemetry validation using structured Threat Detection Opportunities mapped to MITRE ATT&CK.

Context Preservation via Sub-Agents: Isolates high-entropy analytical loops within dedicated sub-agents (detection_strat) to maintain context window integrity.