feat(secops): add comprehensive Chronicle 1P SOAR tool suite and docs - #282
Open
dandye wants to merge 8 commits into
Open
feat(secops): add comprehensive Chronicle 1P SOAR tool suite and docs#282dandye wants to merge 8 commits into
dandye wants to merge 8 commits into
Conversation
- Implement Chronicle 1P CaseService tools (list_cases, get_case, update_case, change_case_priority, change_case_stage, assign_case, set_custom_case_fields, add_case_tag, remove_case_tag, add_case_insight, pause_case_sla, resume_case_sla, close_case, reopen_case) - Implement Chronicle 1P CaseAlertService tools (list_case_alerts, get_case_alert, update_case_alert, change_alert_priority, set_alert_custom_fields, move_case_alert, add_alert_tag, remove_alert_tag) - Support 6 SOAR reaction triggers via Chronicle 1P REST APIs - Add comprehensive test suite in test_secops_case_management.py
…ng formatting in case and alert management
- Add case comments tools (list_case_comments, create_case_comment, post_case_comment) and consolidated get_case_full_details in case_management.py - Add alert grouping and event telemetry tools (list_alert_group_identifiers_by_case, list_events_by_alert, list_involved_events) in case_alert_management.py - Add entity investigation tools (get_involved_entity, list_involved_entities, get_entities_by_alert_group_identifiers, get_entity_details, search_entity) in entity_investigation.py - Add integration and manual action execution tools (list_integrations, list_integration_actions, list_integration_instances, execute_manual_action, get_action_result_by_id) in integration_management.py - Add playbook tools (list_playbooks, get_playbook, list_playbook_instances, execute_playbook, trigger_playbook) in playbook_management.py - Add connector event tools (list_connector_events, get_connector_event) in connector_event_management.py - Export modules in tools/__init__.py and add unit test suite in tests/test_secops_soar_parity.py
…ng format and typing
…ronicle compatibility
…onInstances endpoint
…book, and Connector tools
…nt and parity tests
dandye
changed the title
dandye
marked this pull request as ready for review
September 1, 2026 01:52
dandye
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Comprehensive Chronicle 1P SOAR Tool Suite & Documentation
This PR introduces full first-party (1P) Chronicle SOAR integration to
google-secops-mcp. It expands the server beyond SIEM detections and investigations into complete case management, SOAR reaction triggers, alert grouping, forensic event telemetry streaming, entity investigations, third-party integrations with live connectivity testing, playbook management, connector events, and comprehensive documentation.1. Summary of Changes
A. Case Management & SOAR Reactive Triggers (
case_management.py)list_cases,get_case,update_case(with automatic FieldMask generation).change_case_priority: Dispatches Chronicle SOAR Case Priority Changed trigger.change_case_stage: Dispatches Chronicle SOAR Case Stage Changed trigger.assign_case: Dispatches Chronicle SOAR Case Assignee Changed trigger.set_custom_case_fields: Dispatches Chronicle SOAR Custom Case Field Changed trigger.add_case_tag,remove_case_tag,add_case_insight.pause_case_sla,resume_case_sla,close_case,reopen_case.list_case_comments,create_case_comment(alias:post_case_comment).get_case_full_details: Concurrently fetches case metadata, all attached alerts, and analyst comments viaasyncio.gatherin a single unified payload.B. Case Alert Management & Telemetry Forensics (
case_alert_management.py)list_case_alerts,get_case_alert,update_case_alert,move_case_alert,add_alert_tag,remove_alert_tag.change_alert_priority: Dispatches Chronicle SOAR Alert Priority Changed trigger.set_alert_custom_fields: Dispatches Chronicle SOAR Alert Custom Field Changed trigger.list_alert_group_identifiers_by_case: Correlates multi-alert incident structures.list_events_by_alert(alias:list_involved_events): Streams raw forensic telemetry events that triggered the alert.C. Entity Investigation (
entity_investigation.py)get_involved_entity,list_involved_entities,get_entities_by_alert_group_identifiers.get_entity_details,search_entity(withv1alphaquery parameter fallback).D. Integration Management & Live Testing (
integration_management.py)list_integrations,list_integration_actions,list_integration_instances(/integrations/{id}/integrationInstances).execute_integration_instance_test(POST .../integrationInstances/{id}:executeTest) to verify third-party credentials (e.g. VirusTotal, Slack, SentinelOne) before invoking actions.execute_manual_action,get_action_result_by_id.E. Playbook Lifecycle & Execution (
playbook_management.py)list_playbooks(supportsv1alpha/legacyPlaybooks:legacyGetWorkflowMenuCardsWithEnvFilterwith standard fallback to/v1/.../playbooks).get_playbook,list_playbook_instances,execute_playbook(alias:trigger_playbook).F. Connector Event Management (
connector_event_management.py)list_connector_events,get_connector_event.G. Documentation & Usage Guides
docs/servers/secops_mcp.md: Complete reference documentation covering all parameters, defaults, return types, and end-to-end workflow examples (Example 9: Case Triage & Trigger Workflow, Example 10: VirusTotal Integration Test & Action Execution).server/secops/README.md: Categorized tool index and feature summary.2. Test Verification & Code Quality
pytestandpython -m unittestwith hermetic mocks:tests/test_secops_case_management.py(15 tests)tests/test_secops_soar_parity.py(7 tests)secops-demo-env, instancea13f6726-efed-452e-9008-8fe0d3cb0f75):list_cases: 200 OKlist_integrations: 200 OK (42 configured integrations)list_integration_instances: 200 OK (VirusTotalV3 instance3e9496eb-09cd-4b3c-a4ce-4c788d6663a7)execute_integration_instance_test: 200 OK ({"successful": true, "message": "Successfully connected to the VirusTotal server..."})list_playbooks: 200 OK (50 active playbooks)search_entity: 200 OK%slazy logging, type hints, Google docstrings).