What language is used in Google SecOps to define complex detections with events, matches, and conditions?

• A. YARA-L
• B. SQL
• C. Python
• D. Lua

Answer: (A)

In Google SecOps, detections are expressed using a specialized rule language that models how data from security events should be interpreted and linked. YARA-L is that language. It is built to define rules in terms of events, the matches that result from patterning those events, and the conditions that combine those matches to decide when a detection should fire. This setup matches the typical detection workflow: specify what to look for in the event data, capture when a match occurs, and apply logical, time-based, or relational conditions to determine if the overall rule is satisfied. General-purpose languages like SQL, Python, or Lua don’t encode this multi-event, correlation-focused detection semantics in the same way.