菜单
Author rule notes, parameters, dependencies, tuning, and testing sections for a YARA-L rule.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Extract unstructured legacy rules from a raw text file and structure them into valid JSON.
Take a source SIEM rule and format its content for readability, then insert it into a YARA-L rule template.
Generate a raw sample log entry in the original source format that will trigger the migrated YARA-L rule.
Migrate a source rule section in a YARA-L file into YARA-L 2.0, adhering to precise Google SecOps schemas.
Initialize a new YARA-L rule directory structure and YARA-L rule file from the template.
Full orchestration workflow to migrate a custom SIEM rule to YARA-L, running all sub-steps sequentially.
| name | migration_helper_author_notes |
| description | Author rule notes, parameters, dependencies, tuning, and testing sections for a YARA-L rule. |
Fills in and enriches metadata and guidance sections (RULE PARAMETERS, DEPENDENCIES, TUNING, TESTING, DOCS, NOTES) inside a migrated YARA-L rule file.
/migration_helper_author_notes <rule_name> (where <rule_name> is the name of the rule directory, i.e., rules/<rule_name>/<rule_name>.yaral).Your primary role is to update the RULE PARAMETERS, DEPENDENCIES, TUNING, TESTING, DOCS, and NOTES sections of rules/<rule_name>/<rule_name>.yaral.
rules/<rule_name>/<rule_name>.yaral. If lines are shortened or you receive a truncation error, immediately stop.rules/<rule_name>/<rule_name>.yaral and understand exactly how the rule is configured (what fields are queried, what conditions are checked, etc.).RULE PARAMETERS, DEPENDENCIES, TUNING, TESTING, DOCS, and NOTES inside the YARA-L rule block with your findings.SOURCE RULE or the YARA-L rule logic blocks in any way.