◆ Detection rules

Google SecOps Detection Rules

Apache-2.0

Google's example YARA-L detection rules and dashboards for Google Security Operations (formerly Chronicle).

source ↗ ★ 514 last push 2026-08-06

Summary

This repository contains example YARA-L rules and dashboards for use within Google Security Operations (SecOps) The rules in this repository are distinct from Google SecOps Curated Detections that are developed by Google Cloud Threat Intelligence and designed to generate detections & alerts that are highly actionable. Curated Detections are available to Google SecOps customers with an Enterprise license or higher.

from the project README

Formats: yara-l
License: Apache-2.0
Added: 2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

shell

$ git clone --depth 1 https://github.com/chronicle/detection-rules

Shallow clone: history isn’t needed for testing.

1,084 files 1.1 MB repository

.yaral 922
.py 98
.yaml 22
.md 14
.csv 8
.json 5
(no ext) 5
.txt 5

Google SecOps Detection Rules

Summary

Get it

Contents