ADK Runbooks

A comprehensive multi-agent cybersecurity operations system built on Google's Agent Development Kit (ADK). This project provides specialized AI agents that collaborate to handle complex security operations tasks—including incident response, threat hunting, detection engineering, alert triage, and investigation—powered by a Progressive Disclosure Skills Architecture.

Documentation

The full documentation for this project, including detailed runbooks and agent information, is available at: https://dandye.github.io/adk_runbooks

Overview

ADK Runbooks implements a manager-orchestrated multi-agent system where specialized security agents work together to execute security operations. Instead of inlining entire runbook corpora into system prompts, the system employs Progressive Disclosure: agents receive concise skill catalogs in their context and dynamically load full procedural playbooks, execution guidelines, and rubrics on-demand using specialized skill tools.

Key Features

• Multi-Agent Architecture: A root Manager agent coordinates specialized sub-agents with domain expertise and shared toolsets.
• Dual-Tier Progressive Disclosure Framework:
  • Tier 1 (Skills): 62+ battle-tested security skills organized into standard taxonomy packages (SKILL.md) indexed by SkillRegistry. Agents dynamically fetch step-by-step instructions via load_skill().
  • Tier 2 (MCP Discovery): Client-side progressive tool discovery (MCPToolRegistry) replaces 30+ upfront static JSON parameter schemas with dynamic meta-tools (search_mcp_tools, get_mcp_tool_schema, execute_mcp_tool), achieving 60.5% token reduction beyond skills alone and 94.0% reduction vs monolithic prompts.
• Detection-as-Code (DAC) & Google SecOps 1P MCP Integration: Dedicated dac-agent and Detection Engineer sub-agent integrated with Google Cloud SecOps 1P Agentic Detection Engineering MCP Server (70+ tools for TDO extraction, synthetic UDM events, coverage evaluation, and YARA-L rule generation).
• Enterprise Security MCP Tooling: Unified integration across Chronicle SIEM, Chronicle SOAR, VirusTotal / Google Threat Intelligence (GTI), and SecOps Detection Engineering.
• Rigorous Evaluation & Benchmarking: 4-rubric graph workflow evaluation framework covering 36+ end-to-end security operations workflows with automated scoring, latency measurement, token usage tracking, and Markdown/JSON report generation.

---

Dual Progressive Disclosure Architecture

Operational procedures and external MCP tools are loaded strictly on-demand to prevent prompt bloat and context degradation: