Menu
Extract unstructured legacy rules from a raw text file and structure them into valid JSON.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Author rule notes, parameters, dependencies, tuning, and testing sections for a YARA-L rule.
Take a source SIEM rule and format its content for readability, then insert it into a YARA-L rule template.
Generate a raw sample log entry in the original source format that will trigger the migrated YARA-L rule.
Migrate a source rule section in a YARA-L file into YARA-L 2.0, adhering to precise Google SecOps schemas.
Initialize a new YARA-L rule directory structure and YARA-L rule file from the template.
Full orchestration workflow to migrate a custom SIEM rule to YARA-L, running all sub-steps sequentially.
| name | migration_helper_extract |
| description | Extract unstructured legacy rules from a raw text file and structure them into valid JSON. |
Parses a file containing unstructured customer SIEM rules and formats them into a clean, structured JSON file that can be ingested by the recommender.
/migration_helper_extract <source_rules_file_path> or when extracting custom rules from loose text format.Your goal is to extract legacy rules from the provided <source_rules_file_path> and structure them into a valid JSON file.
Load File: Load the file <source_rules_file_path> and process it record by record, keeping in mind that different rule syntaxes may be mixed.
Field Extraction: Understand each rule and extract/generate the following fields for each:
ucid: The Case or rule ID (or suggest/generate one if missing).title: A one-sentence title of the rule.description: The rule's description (analyze the rule and suggest one if missing, or put "N/A" if not sure).rule: The exact original input rule logic, completely unmodified.Save to JSON: Write the structured records into a JSON file under ./recommender_curated_community/work_dir/input_rules_YYYYMMDD.json (replacing YYYYMMDD with the current date).
Format template:
[
{
"ucid": "<Case or rule ID>",
"title": "<Title of the rule>",
"description": "<Description>",
"rule": "<Original input rule logic without modifications>"
}
]
Validate JSON: Double check that the final JSON file is syntactically valid and parses correctly.
Report Results: Print the exact absolute or relative file path where you saved the structured JSON results.