Menu
Extract unstructured legacy rules from a raw text file and structure them into valid JSON.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Author rule notes, parameters, dependencies, tuning, and testing sections for a YARA-L rule.
Take a source SIEM rule and format its content for readability, then insert it into a YARA-L rule template.
Generate a raw sample log entry in the original source format that will trigger the migrated YARA-L rule.
Migrate a source rule section in a YARA-L file into YARA-L 2.0, adhering to precise Google SecOps schemas.
Initialize a new YARA-L rule directory structure and YARA-L rule file from the template.
Full orchestration workflow to migrate a custom SIEM rule to YARA-L, running all sub-steps sequentially.
| name | migration_helper_extract |
| description | Extract unstructured legacy rules from a raw text file and structure them into valid JSON. |
Parses a file containing unstructured customer SIEM rules and formats them into a clean, structured JSON file that can be ingested by the recommender.
/migration_helper_extract <source_rules_file_path> or when extracting custom rules from loose text format.Your goal is to extract legacy rules from the provided <source_rules_file_path> and structure them into a valid JSON file.
Load File: Load the file <source_rules_file_path> and process it record by record, keeping in mind that different rule syntaxes may be mixed.
Field Extraction: Understand each rule and extract/generate the following fields for each:
ucid: The Case or rule ID (or suggest/generate one if missing).title: A one-sentence title of the rule.description: The rule's description (analyze the rule and suggest one if missing, or put "N/A" if not sure).rule: The exact original input rule logic, completely unmodified.Save to JSON: Write the structured records into a JSON file under ./recommender_curated_community/work_dir/input_rules_YYYYMMDD.json (replacing YYYYMMDD with the current date).
Format template:
[
{
"ucid": "<Case or rule ID>",
"title": "<Title of the rule>",
"description": "<Description>",
"rule": "<Original input rule logic without modifications>"
}
]
Validate JSON: Double check that the final JSON file is syntactically valid and parses correctly.
Report Results: Print the exact absolute or relative file path where you saved the structured JSON results.