I found an open issue on Google's own security repo, so I built the missing piece

说明与用途

作者发现 Google Chronicle 缺乏对 Agent Threat Rules (ATR) 的支持，无法检测 AI 代理威胁。他创建了 Python 工具 atr-to-yaral，将 ATR YAML 规则转换为 YARA‑L 2.0，支持批量转换并通过 content_manager 集成到 Chronicle。

问题

Google Chronicle lacked a way to ingest and apply Agent Threat Rules (ATR) for AI agent threat detection.

结果

ATR rules are now usable in Chronicle, allowing detection of prompt injection, tool poisoning, and other AI agent threats.

工作流

• Identify ATR rule files
• Run atr-to-yaral to generate .yaral files
• Validate and push rules with content_manager into Chronicle

证据

ATR has grown fast. 680+ rules, adopted into Microsoft's Agent Governance Toolkit, Cisco AI Defense, MISP, and cross-listed by SigmaHQ as a sibling format to Sigma itself.

来源

I built it.

来源