Google SecOps SOAR MCP server
Listed on its own since 2026-09-26. Until then it was part of google-secops-mcp, where its earlier checks remain.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"secops-soar-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Chronicle SecOps SOAR MCP Server This is an MCP (Model Context Protocol) server for interacting with Google's Chronicle Security Operations SOAR suite. [MCP Info](https://modelcontextprotocol.io/introduction) ## Features ### Core Tools (Case Management & Entities) - **`list_cases()`** - Lists available cases in the SOAR platform. - **`post_case_comment(case_id, comment)`** - Adds a textual comment to a specific case. - **`list_alerts_by_case(case_id)`** - Lists all alerts associated with a specific case ID. - **`list_alert_group_identifiers_by_case(case_id)`** - Lists the unique group identifiers for alerts within a specific case. - **`list_events_by_alert(case_id, alert_id)`** - Lists the events associated with a particular alert within a given case. - **`change_case_priority(case_id, case_priority)`** - Modifies the priority level of a specific case. - **`get_entities_by_alert_group_identifiers(case_id, alert_group_identifiers)`** - Retrieves entities involved in one or more alert groups. - **`get_entity_details(entity_identifier, entity_type, entity_environment)`** - Fetches detailed information about a specific entity. - **`search_entity(term=None, type=None, is_suspicious=None, is_internal_asset=None, is_enriched=None, network_name=None, environment_name=None)`** - Searches for entities within the SOAR platform. - **`get_case_full_details(case_id)`** - Retrieves comprehensive details for a single case. ### Dynamic Integration Tools (Marketplace) This server can dynamically load additional tools based on integrations enabled via the `--integrations` command-line flag when the server is started. These tools correspond to modules found in the `marketplace/` directory. Available integrations include: - ServiceNow - CSV - Jira - Slack - Email - VirusTotal - Active Directory - Microsoft Defender ATP - And many more ## Installing in Claude Desktop To use this MCP server with Claude Desktop: 1. Install Claude Desktop 2. Open Claude Desktop and select "S…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.