feat(secops): add Detection Engineering Agent MCP tools and coverage evaluation skill

[dandye]

Summary

Implements support for the newly launched Google SecOps Agentic Detection Engineering (ADE) APIs in secops-mcp and introduces the canonical detection-engineering-coverage-evaluation skill for Antigravity and Gemini CLI agents.

This enables security teams and autonomous agents to automate the end-to-end detection engineering lifecycle: ingesting threat intelligence, generating Threat Detection Opportunities (TDOs), simulating attacker behavior with synthetic UDM events, running isolated rule coverage evaluations via Chronicle Long-Running Operations (LRO), synthesizing candidate YARA-L 2.0 rules for identified coverage gaps, and deploying verified detections with explicit human-in-the-loop authorization.

Reference documentation: Agentic Detection Engineering in Google SecOps

---

Changes

1. New Detection Engineering MCP Tools (server/secops/secops_mcp/tools/detection_agent.py)

Adds 5 new tools to the SecOps FastMCP toolset:

• generate_threat_detection_opportunity: Generates structured Threat Detection Opportunities (TDOs) from natural-language threat intel descriptions and target log types.
• generate_synthetic_events: Simulates attacker activity by synthesizing realistic raw logs, UDM event records, and JSON-encoded UDM strings for specific TDOs.
• evaluate_rule_coverage_long_running: Initiates a Chronicle LRO (:evaluateRuleCoverageLongRunning) to evaluate synthetic events against active rulesets in a safe sandbox simulation without writing mock data to production storage. Supports optional composite coverage exclusion.
• get_operation: Polls standard Google Long-Running Operations (LRO) until completion, surfacing progress metadata and final evaluation responses.
• generate_rules: Synthesizes production-ready candidate YARA-L 2.0 detection rules specifically tailored to close uncovered TDOs and coverage gaps.

All tools are registered in FastMCP and exported via server/secops/secops_mcp/tools/__init__.py.

2. Detection Engineering Coverage Evaluation Skill (extensions/google-secops/skills/detection-coverage/)

Adds the detection-engineering-coverage-evaluation skill (available via .agent/skills/detection-coverage/SKILL.md):

• Lifecycle Runbook: Structured 8-stage detection pipeline (Intel Ingestion $\rightarrow$ TDO Generation $\rightarrow$ Synthetic Simulation $\rightarrow$ Rule Coverage Evaluation $\rightarrow$ Gap Analysis $\rightarrow$ YARA-L 2.0 Rule Generation $\rightarrow$ Verification $\rightarrow$ Deployment).
• Prompt Injection Defense: Enforces strict demarcation when parsing untrusted external threat reports, blog posts, and markdown feeds.
• Safety Gate: Requires explicit user confirmation with full rule preview before creating or enabling rules in production.

3. Persona & Tool Mapping Documentation

• docs/personas/detection_engineer.md: Updated Detection Engineer persona documentation to detail ADE tools, workflows, and sample execution flows.
• extensions/google-secops/TOOL_MAPPING.md: Added the Detection Engineering tool category mapping.
• extensions/google-secops/GEMINI.md: Added Skill 6 (detection-engineering-coverage-evaluation) to the extensions registry.

4. Git Hygiene & Secret Isolation

• Added .envrc and .gcloud/ to .gitignore to prevent credential and local configuration leakage when using direnv and local Application Default Credentials (ADC).

---

Verification & Testing

Unit Tests

• Added server/secops/tests/test_secops_detection_agent_unit.py containing 12 async unit tests.
• Tests cover endpoint routing, request body structure, parameter aliases (tdo_events, threat_detection_opportunities, opportunity_events), JSON serialization, and error handling for all 5 tools.
• All 12 unit tests pass:

  uv run --with pytest --with pytest-asyncio pytest server/secops/tests/test_secops_detection_agent_unit.py
  # 12 passed in 0.65s

• Linting and code formatting verified clean:

  uv run --with ruff ruff check server/secops/secops_mcp/tools/detection_agent.py server/secops/tests/test_secops_detection_agent_unit.py
  # All checks passed!
  uv run --with ruff ruff format --check server/secops/secops_mcp/tools/detection_agent.py server/secops/tests/test_secops_detection_agent_unit.py
  # 2 files already formatted

Live Tenant Verification

Verified end-to-end execution against a live Google SecOps tenant using ADC:

1. generate_threat_detection_opportunity: Successfully extracted TDOs (t01, t02) for PowerShell-based C2 communication.
2. generate_synthetic_events: Successfully generated 8 synthetic UDM events simulating suspicious PowerShell process launches and outbound network connections.
3. evaluate_rule_coverage_long_running: Initiated LRO (operations/dea-bkFXS0...) with synthetic events.
4. get_operation: Polled operation status to retrieve coverage results.
5. generate_rules: Successfully synthesized candidate YARA-L 2.0 rule (ttp_suspicious_powershell_network_connection) closing the identified gap.

TAG=agy
CONV=b434fecb-6fd3-4841-b909-49d23ef70fa3