MCP Tools Reference: chronicle.googleapis.com

Tool: get_agent_settings

Retrieves the current configuration settings for the SecOps Investigation Agent within a specific SecOps instance.

This tool allows users or other agents to inspect the behavior of the automated investigation agent, such as whether it's enabled, how long it waits before starting an investigation, and any filters controlling which alerts it processes.

Workflow Integration:

  • Conversational Interfaces: Enables a chat agent to answer user questions about the Investigation Agent's current setup (e.g., "Is auto-investigation turned on?", "What is the current alert filter for the investigation agent?").
  • Pre-check for Updates: Useful to call before attempting an update via update_agent_settings to see the current state of the investigation agent.
  • Auditing & Verification: Allows administrators to verify that the investigation agent is configured as expected.

Use Cases:

  • Chat Q&A: User: "Is the Investigation Agent active?"
  • Chat Q&A: User: "What's the delay before the investigation agent starts an auto-investigation?"
  • Chat Q&A: User: "Are there any filters applied to the Investigation Agent?"
  • An administrator checks the settings before making changes to the investigation agent's behavior.
  • An automated script fetches the settings to ensure compliance with security policies.

Example Usage:

  • get_agent_settings(projectId='123', region='us', customerId='abc')

Next Steps (using MCP-enabled tools):

  • Based on the returned settings, the user/agent might decide to:
  • Trigger a manual investigation using trigger_investigation if auto-investigation is disabled or the alert was filtered out.
  • Inform the user of the current configuration in response to their query.

The following sample demonstrate how to use curl to invoke the get_agent_settings MCP tool.

Curl Request 
                  
curl --location 'https://chronicle.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "get_agent_settings",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

This message represents the request to get the agent settings for a customer.

GetAgentSettingsRequest

JSON representation 
{
  "projectId": string,
  "customerId": string,
  "region": string
}
Fields
projectId

string

Required. Google Cloud project ID (e.g., "my-chronicle-project").
customerId

string

Required. SecOps customer ID (UUID).
region

string

Required. SecOps region (e.g., "us", "europe").

Output Schema

This message represents the agent settings for an instance

AgentSettings

JSON representation 
{
  "name": string,
  "autoInvestigationEnabled": boolean,
  "alertFilter": string,
  "autoInvestigationDelay": string,
  "quotaInfo": {
    object (QuotaInfo)
  },
  "aiSecurityTokenBillingSettings": {
    object (AiSecurityTokenBillingSettings)
  }
}
Fields
name

string

Identifier. The resource name of the AgentSettings. Format: projects/{project}/locations/{location}/instances/{instance}/agentSettings
autoInvestigationEnabled

boolean

Optional. Whether auto investigation is enabled for the instance.
alertFilter

string

Optional. A single AIP-160 string representing the instance provided alert filters used for auto investigation when default settings are disabled, e.g. “detection.rule_name = /enumeration/ AND detection.detection.rule_id != 1234 AND udm.metadata.event_type = /USER_LOGIN/”.
autoInvestigationDelay

string (Duration format)

Optional. The delay after which auto investigation will be triggered for an alert when default settings are disabled. This is only applied if auto_investigation_enabled is true.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
quotaInfo

object (QuotaInfo)

Output only. The quota information for the instance.
aiSecurityTokenBillingSettings

object (AiSecurityTokenBillingSettings)

Optional. Billing and Token controls for AI features.

Duration

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
nanos

integer

Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 seconds field and a positive or negative nanos field. For durations of one second or more, a non-zero value for the nanos field must be of the same sign as the seconds field. Must be from -999,999,999 to +999,999,999 inclusive.

QuotaInfo

JSON representation 
{
  "autoInvestigationsQuotaLimit": string,
  "manualInvestigationsQuotaLimit": string
}
Fields
autoInvestigationsQuotaLimit

string (int64 format)

Output only. The quota limit for auto investigations for the instance.
manualInvestigationsQuotaLimit

string (int64 format)

Output only. The quota limit for manual investigations for the instance.

AiSecurityTokenBillingSettings

JSON representation 
{
  "paidTokenEnabled": boolean,
  "billingModel": enum (BillingModel),
  "includedTokenCount": string,
  "updateTime": string,
  "totalPaidTokenAllocation": string,
  "usedIncludedTokens": string,
  "usedPaidTokens": string,

  // Union field _daily_paid_token_limit can be only one of the following:
  "dailyPaidTokenLimit": string
  // End of list of possible types for union field _daily_paid_token_limit.
}
Fields
paidTokenEnabled

boolean

Required. Bool representing whether customer has opted their tenant in to Paid Security Tokens. They will only be able to toggle this on if they have a valid BillingModel set.
billingModel

enum (BillingModel)

Output only. The billing model describes how they're billed based on the SKU purchased by the customer.
includedTokenCount

string (int64 format)

Output only. Total daily baseline complimentary token budget included with the purchased package tier.
updateTime

string (Timestamp format)

Output only. Timestamp of the last mutation to these settings.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
totalPaidTokenAllocation

string (int64 format)

Output only. Total reservoir of paid Security Tokens allocated to this tenant.
usedIncludedTokens

string (int64 format)

Output only. Used tokens from the baseline complimentary budget today.
usedPaidTokens

string (int64 format)

Output only. Total paid tokens consumed from the allocation.

Union field _daily_paid_token_limit.

_daily_paid_token_limit can be only one of the following:
dailyPaidTokenLimit

string (int64 format)

Optional. Granular daily cap in paid Security Tokens.

Timestamp

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

BillingModel

The billing model describes how they're billed based on the SKU purchased by the customer.

Enums
BILLING_MODEL_UNSPECIFIED Default unspecified billing model.
SUBSCRIPTION Subscription-based billing model.
PAYGO Pay-As-You-Go billing model.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌