{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_hvv739n3krdy","handle":"secops-soar-mcp","url":"https://wellknown.network/agents/secops-soar-mcp","links":{"self":"https://wellknown.network/agents/secops-soar-mcp/record.json","html":"https://wellknown.network/agents/secops-soar-mcp","markdown":"https://wellknown.network/agents/secops-soar-mcp/record.md","api":"https://wellknown.network/api/v1/agents/secops-soar-mcp","status":"https://wellknown.network/api/v1/agents/secops-soar-mcp/status","claim":"https://wellknown.network/agents/secops-soar-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/secops-soar-mcp/claim.json","badge":"https://wellknown.network/agents/secops-soar-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/secops-soar-mcp/history","tools":"https://wellknown.network/api/v1/agents/secops-soar-mcp/tools"},"ard":{"identifier":"urn:air::server:secops-soar-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"secops-soar-mcp","summary":"Google SecOps SOAR MCP server","description":"# Chronicle SecOps SOAR MCP Server\n\nThis is an MCP (Model Context Protocol) server for interacting with Google's\nChronicle Security Operations SOAR suite.\n[MCP Info](https://modelcontextprotocol.io/introduction)\n\n## Features\n\n### Core Tools (Case Management & Entities)\n\n- **`list_cases()`** - Lists available cases in the SOAR platform.\n- **`post_case_comment(case_id, comment)`** - Adds a textual comment to a specific case.\n- **`list_alerts_by_case(case_id)`** - Lists all alerts associated with a specific case ID.\n- **`list_alert_group_identifiers_by_case(case_id)`** - Lists the unique group identifiers for alerts within a specific case.\n- **`list_events_by_alert(case_id, alert_id)`** - Lists the events associated with a particular alert within a given case.\n- **`change_case_priority(case_id, case_priority)`** - Modifies the priority level of a specific case.\n- **`get_entities_by_alert_group_identifiers(case_id, alert_group_identifiers)`** - Retrieves entities involved in one or more alert groups.\n- **`get_entity_details(entity_identifier, entity_type, entity_environment)`** - Fetches detailed information about a specific entity.\n- **`search_entity(term=None, type=None, is_suspicious=None, is_internal_asset=None, is_enriched=None, network_name=None, environment_name=None)`** - Searches for entities within the SOAR platform.\n- **`get_case_full_details(case_id)`** - Retrieves comprehensive details for a single case.\n\n### Dynamic Integration Tools (Marketplace)\n\nThis server can dynamically load additional tools based on integrations enabled via the `--integrations` command-line flag when the server is started. These tools correspond to modules found in the `marketplace/` directory.\n\nAvailable integrations include:\n- ServiceNow\n- CSV\n- Jira\n- Slack\n- Email\n- VirusTotal\n- Active Directory\n- Microsoft Defender ATP\n- And many more\n\n## Installing in Claude Desktop\n\nTo use this MCP server with Claude Desktop:\n\n1.  Install Claude Desktop\n\n2.  Open Claude Desktop and select \"S…","publisher":null,"homepage":"https://github.com/google/mcp-security/tree/main/server/secops-soar#readme","repository":"https://github.com/google/mcp-security/tree/main/server/secops-soar#readme","version":"0.1.2","license":null,"protocols":["mcp"],"tags":["google","security","chronicle","secops","soar","gti","mcp"],"pricing":null,"endpoints":[{"url":"pypi:secops-soar-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[],"categories":[],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"secops-soar-mcp","registry":"pypi","observedAt":"2026-11-04T00:27:26.398Z","publishedAt":"2026-08-27T23:16:42.936876Z","latestVersion":"0.1.2"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"secops-soar-mcp","url":"https://pypi.org/project/secops-soar-mcp/","firstSeenAt":"2026-09-10T12:21:16.353Z","fetchedAt":"2026-11-04T00:25:56.578Z","normalizedAt":"2026-11-04T00:25:56.578Z"}]},"firstSeenAt":"2026-09-10T12:21:16.353Z","updatedAt":"2026-11-04T00:27:26.398Z"}