As SIEM admins, we all get asked for the same thing every so often: "export the rules — give me everything we run." It's routine, and it shows up a lot in audit and compliance.😅
Most of the time we don't want to stand up a whole versioning / detection-as-code setup just for that. We just want to export our rules, the way you can in pretty much any other SIEM.
Google SecOps doesn't really hand you that today. The docs on this are either thin or jump straight to a full detection-as-code pipeline with Terraform, Git, and CI/CD — great if you run a platform team, overkill if you just need a copy of your rules.
So I wrote the simple middle: a small, read-only Python script.
- - Pulls every rule via list_rules (it never modifies anything).
- - Writes an Excel, one row per rule, with each meta field and each outcome variable as its own column — filterable and readable.
- - Also drops one .yaral file per rule as a literal backup.
Requirements: a service account with chronicle.rules.list, and pip install secops openpyxl. That's it.
If you want to change what it exports, you don't need to know Python — there's an EDIT ZONE at the top where you flip a couple of True/False toggles or add column names to exclude (add/remove columns, turn the .yaral backup on or off, thin out the outcome columns).
Repo: https://github.com/gromerosec/google-secops-rule-export
Full write-up: Google SecOps Field Notes: A Simple Way to Export Your Rules
https://medium.com/@gromerosec/google-secops-field-notes-a-simple-way-to-export-your-rules-d61f0aa7f79d?sharedUserId=gromerosec
Hope it helps someone. Cheers.
