I found an open issue on Google's own security repo, so I built the missing piece

Description and use

The author found that Google Chronicle lacked support for Agent Threat Rules (ATR) to detect AI agent threats. He built a Python tool, atr-to-yaral, that converts ATR YAML rules to YARA‑L 2.0, enabling batch conversion and integration into Chronicle via content_manager.

Problem

Google Chronicle lacked a way to ingest and apply Agent Threat Rules (ATR) for AI agent threat detection.

Outcome

ATR rules are now usable in Chronicle, allowing detection of prompt injection, tool poisoning, and other AI agent threats.

Workflow

• Identify ATR rule files
• Run atr-to-yaral to generate .yaral files
• Validate and push rules with content_manager into Chronicle

Evidence

ATR has grown fast. 680+ rules, adopted into Microsoft's Agent Governance Toolkit, Cisco AI Defense, MISP, and cross-listed by SigmaHQ as a sibling format to Sigma itself.

Source

I built it.

Source