Menu
Run the recommender script to generate recommendations for SecOps curated/community rules based on custom rules.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Author rule notes, parameters, dependencies, tuning, and testing sections for a YARA-L rule.
Extract unstructured legacy rules from a raw text file and structure them into valid JSON.
Take a source SIEM rule and format its content for readability, then insert it into a YARA-L rule template.
Generate a raw sample log entry in the original source format that will trigger the migrated YARA-L rule.
Migrate a source rule section in a YARA-L file into YARA-L 2.0, adhering to precise Google SecOps schemas.
Initialize a new YARA-L rule directory structure and YARA-L rule file from the template.
| name | migration_helper_recommend |
| description | Run the recommender script to generate recommendations for SecOps curated/community rules based on custom rules. |
Runs the interactive recommender tool to match legacy custom SIEM rules in JSON format with equivalent Google SecOps Curated or Community rules.
/migration_helper_recommend <json_rules_path> or when recommending rules.Your objective is to execute the interactive recommender script using the provided input rules file <json_rules_path>.
<json_rules_path> is empty, stop and ask the user to provide the path to the JSON file containing their customer rules.run_recommender.sh <json_rules_path> from the workspace directory or inside the recommender_curated_community folder.
TAB to focus on the terminal/script interface if they need to interact.