MCP Tools Reference: chronicle.googleapis.com

Tool: list_integration_instances

Lists all configured instances for a given SOAR Integration. You can also list instances across all integrations by passing "-" as the integration_id. Each instance returned contains a name field which is its resource name (e.g., projects/.../integrations/.../instances/{instance_guid}). The {instance_guid} at the end of this name is the IntegrationInstance GUID required by the execute_manual_action tool when running script-based actions.

Retrieves a paginated list of all configured integration instances, which are specific configurations of an integration. This is useful for discovering the specific instances of an integration that are available for use in playbooks and manual actions.

Workflow Integration:

  • Used to populate a UI with a list of available integration instances for an analyst to choose from.
  • Enables automated systems to discover and verify that required integration instances are present before executing a playbook that depends on them.
  • Essential for auditing and managing the inventory of all third-party connections in the SOAR platform.

Use Cases:

  • A security analyst lists available integration instances to find the correct instance to use for a specific task.
  • A SOAR engineer reviews the list of all integration instances to identify any that need to be updated, configured, or retired.
  • An automated script queries for a specific integration instance by name to ensure it is installed before running a playbook that uses its actions.

Example Usage:

  • list_integration_instances(projectId='123', region='us', customerId='abc', integrationId='my-integration')
  • list_integration_instances(projectId='123', region='us', customerId='abc', integrationId='-')

Next Steps (using MCP-enabled tools):

  • Use the GUID from the name field of an instance as the IntegrationInstance value in the properties dictionary when calling execute_manual_action for script-based actions.

The following sample demonstrate how to use curl to invoke the list_integration_instances MCP tool.

Curl Request 
                  
curl --location 'https://chronicle.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "list_integration_instances",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for ListIntegrationInstances.

ListIntegrationInstancesRequest

JSON representation 
{
  "projectId": string,
  "customerId": string,
  "region": string,
  "integrationId": string,
  "pageSize": integer,
  "pageToken": string,
  "filter": string,
  "orderBy": string
}
Fields
projectId

string

Required. Google Cloud project ID.
customerId

string

Required. Chronicle customer ID.
region

string

Required. Chronicle region (e.g., "us", "europe").
integrationId

string

The ID of the integration to list instances for (required). If "-" is provided, instances for all integrations will be listed.
pageSize

integer

The maximum number of integration instances to return in a single response. If unspecified, the server will use a default page size.
pageToken

string

A token for fetching a specific page of results, obtained from a previous call.
filter

string

A filter string to apply to the list of integration instances.
orderBy

string

The field to order the results by.

Output Schema

Response message for ListIntegrationInstances.

ListIntegrationInstancesResponse

JSON representation 
{
  "integrationInstances": [
    {
      object (IntegrationInstance)
    }
  ],
  "nextPageToken": string,
  "totalSize": integer
}
Fields
integrationInstances[]

object (IntegrationInstance)

The list of IntegrationInstances.
nextPageToken

string

Optional. A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.
totalSize

integer

The total number of IntegrationInstances.

IntegrationInstance

JSON representation 
{
  "name": string,
  "environment": string,
  "displayName": string,
  "parameters": [
    {
      object (IntegrationInstanceParameter)
    }
  ],
  "integrationIdentifier": string,
  "identifier": string,

  // Union field _description can be only one of the following:
  "description": string
  // End of list of possible types for union field _description.

  // Union field _configured can be only one of the following:
  "configured": boolean
  // End of list of possible types for union field _configured.

  // Union field _remote can be only one of the following:
  "remote": boolean
  // End of list of possible types for union field _remote.

  // Union field _agent can be only one of the following:
  "agent": string
  // End of list of possible types for union field _agent.

  // Union field _system_default can be only one of the following:
  "systemDefault": boolean
  // End of list of possible types for union field _system_default.
}
Fields
name

string

Identifier. The unique name of the integration instance. Format: projects/{project}/locations/{location}/instances/{instance}/integrations/{integration}/integrationInstances/{instance}
environment

string

Required. The integration instance environment.
displayName

string

Optional. The display name of the integration instance. Automatically generated if not assigned. Limited to 110 characters.
parameters[]

object (IntegrationInstanceParameter)

Optional. Integration's parameters.
integrationIdentifier

string

Output only. The integration identifier.
identifier

string

Output only. The integration instance identifier.

Union field _description.

_description can be only one of the following:
description

string

Optional. The integration instance description. Limited to 1500 characters.

Union field _configured.

_configured can be only one of the following:
configured

boolean

Output only. Determines whether the integration instance is configured.

Union field _remote.

_remote can be only one of the following:
remote

boolean

Output only. True if the integration instance is a remote instance. Instance is created with remote = false by default.

Union field _agent.

_agent can be only one of the following:
agent

string

Optional. The agent identifier for a remote integration instance

Union field _system_default.

_system_default can be only one of the following:
systemDefault

boolean

Output only. Indicates whether the integration instance is the system default.

IntegrationInstanceParameter

JSON representation 
{
  "id": string,
  "displayName": string,
  "type": enum (IntegrationParameterType),

  // Union field _description can be only one of the following:
  "description": string
  // End of list of possible types for union field _description.

  // Union field _property_name can be only one of the following:
  "propertyName": string
  // End of list of possible types for union field _property_name.

  // Union field _mandatory can be only one of the following:
  "mandatory": boolean
  // End of list of possible types for union field _mandatory.

  // Union field _value can be only one of the following:
  "value": string
  // End of list of possible types for union field _value.
}
Fields
id

string (int64 format)

Output only. The unique id of the integration instance parameter.
displayName

string

Output only. The integration instance parameter display name.
type

enum (IntegrationParameterType)

Output only. The integration instance parameter type.

Union field _description.

_description can be only one of the following:
description

string

Output only. The integration instance parameter description.

Union field _property_name.

_property_name can be only one of the following:
propertyName

string

Output only. The integration instance parameter property name.

Union field _mandatory.

_mandatory can be only one of the following:
mandatory

boolean

Output only. Indicates if the parameter is required when configuring the integration instance.

Union field _value.

_value can be only one of the following:
value

string

Optional. The parameter's value.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌