MCP Tools Reference: chronicle.googleapis.com

Tool: update_case

Updates an existing case in Google SecOps.

Modifies various properties of a specific case. Only the fields provided in the arguments will be updated. Note: It is not possible to change the status of a case to 'CLOSED' using this tool. This can only be done via the 'execute_bulk_close_case' tool.

Workflow Integration: - A core function for managing the lifecycle of a security case, used in both manual and automated workflows. - Integrates with UI actions like assigning a case, changing its status, or adding a description. - Essential for automated playbooks that need to update a case's status after performing an action, such as "Case moved to 'Remediation' after host was isolated." - Can be used to synchronize case status with external ticketing or project management systems.

Use Cases: - An analyst assigns a case to themselves or another team member. - A SOC manager escalates a case by changing its priority from "Medium" to "Critical". - A user adds a detailed description or updates the title of a case to better reflect the investigation's findings. - Add or modify tags and products associated with the case.

Args: project_id (str): Google Cloud project ID (required). customer_id (str): Chronicle customer ID (required). region (str): Chronicle region (e.g., "us", "europe") (required). case_id (str): The numeric ID of the Case to update (e.g., '12345'). This is a required field. display_name (str, optional): The new display name for the case. stage (str, optional): The new stage of the case. The Stage options are: ['Research', 'Improvement', 'Incident', 'Investigation', 'Assessment', 'Triage']. priority (backstory.Priority, optional): The new priority of the case (e.g., "PRIORITY_HIGH", "PRIORITY_CRITICAL"). important (bool, optional): Whether the case is marked as important. incident (bool, optional): Whether the case is marked as an incident. assignee (str, optional): The user or role to assign to the case. description (str, optional): The new description for the case. environment (str, optional): The environment associated with the case. move_environment (google.cloud.chronicle.v1alpha.Case.MoveEnvironment, optional): Details about moving the case to a different environment.

Returns: Case: The updated Case object with the new values. The Case object contains the following key fields: - Name (str): The full resource name of the case. - Id (int): The unique identifier for the case. - DisplayName (str): The title or display name of the case. - Stage (str): The current stage of the case (e.g., "Triage", "Investigation"). - Priority (str): The priority of the case (e.g., "PRIORITY_HIGH"). - Assignee (str): The user or group assigned to the case. - Description (str): A detailed description of the case. - Status (str): The current status of the case (e.g., "OPENED", "CLOSED"). - CreateTime (int): The creation timestamp of the case in milliseconds. - UpdateTime (int): The last update timestamp of the case in milliseconds. - Tags (list of str): A list of tags associated with the case. - Products (list of str): A list of products associated with the case. Returns an error message if the case is not found, the user lacks permission, or the update is invalid.

Example Usage: # Update the assignee and priority of a case update_case( project_id='123', region='us', customer_id='abc', case_id='456', assignee='new_user@example.com', priority='PRIORITY_CRITICAL' )

# Change the stage and add a description
        update_case(
            project_id='123',
            region='us',
            customer_id='abc',
            case_id='789',
            stage='Investigation',
            description='Escalated for further investigation due to new IOCs.'
        )

        # Mark as important
        update_case(
            project_id='123',
            region='us',
            customer_id='abc',
            case_id='101',
            important=True
        )

Next Steps (using MCP-enabled tools): - Use 'get_case' with the case's resource name to verify that the case has been updated correctly. - Use 'list_case_comments' to see if any comments were added as part of the update. - Use 'create_case_comment' to add a note explaining why the case was updated.

The following sample demonstrate how to use curl to invoke the update_case MCP tool.

Curl Request 
                  
curl --location 'https://chronicle.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "update_case",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for UpdateCase. Next ID: 21

UpdateCaseRequest

JSON representation 
{
  "projectId": string,
  "customerId": string,
  "region": string,
  "caseId": string,
  "tags": [
    {
      object (CaseTag)
    }
  ],
  "products": [
    {
      object (CaseProduct)
    }
  ],

  // Union field _display_name can be only one of the following:
  "displayName": string
  // End of list of possible types for union field _display_name.

  // Union field _stage can be only one of the following:
  "stage": string
  // End of list of possible types for union field _stage.

  // Union field _priority can be only one of the following:
  "priority": enum (Priority)
  // End of list of possible types for union field _priority.

  // Union field _important can be only one of the following:
  "important": boolean
  // End of list of possible types for union field _important.

  // Union field _incident can be only one of the following:
  "incident": boolean
  // End of list of possible types for union field _incident.

  // Union field _assignee can be only one of the following:
  "assignee": string
  // End of list of possible types for union field _assignee.

  // Union field _description can be only one of the following:
  "description": string
  // End of list of possible types for union field _description.

  // Union field _type can be only one of the following:
  "type": enum (CaseType)
  // End of list of possible types for union field _type.

  // Union field _environment can be only one of the following:
  "environment": string
  // End of list of possible types for union field _environment.

  // Union field _move_environment can be only one of the following:
  "moveEnvironment": {
    object (MoveEnvironment)
  }
  // End of list of possible types for union field _move_environment.

  // Union field _score can be only one of the following:
  "score": number
  // End of list of possible types for union field _score.

  // Union field _sla can be only one of the following:
  "sla": {
    object (Sla)
  }
  // End of list of possible types for union field _sla.

  // Union field _involved_suspicious_entity can be only one of the following:
  "involvedSuspiciousEntity": boolean
  // End of list of possible types for union field _involved_suspicious_entity.

  // Union field _closure_details can be only one of the following:
  "closureDetails": {
    object (CaseClosureDetails)
  }
  // End of list of possible types for union field _closure_details.
}
Fields
projectId

string

Project ID of the customer.
customerId

string

Customer ID of the customer.
region

string

Region of the customer.
caseId

string

Case ID of the case to update.
tags[]

object (CaseTag)

CaseTags associated with the case.
products[]

object (CaseProduct)

Products associated with the case.

Union field _display_name.

_display_name can be only one of the following:
displayName

string

Case to update.

Union field _stage.

_stage can be only one of the following:
stage

string

The stage of the Case. For example, "Triage", "Incident", "Investigation". Stages are defined in "chronicle.googleapis.com/CaseStageDefinition". The default stage option is "Triage".

Union field _priority.

_priority can be only one of the following:
priority

enum (Priority)

Default value is HIGH. Case priority. For example, "Informative", "Low", "Medium", "High", "Critical".

Union field _important.

_important can be only one of the following:
important

boolean

Additional way to specify case importance. The default is false.

Union field _incident.

_incident can be only one of the following:
incident

boolean

Additional way to specify if the case marked as incident. The default is false.

Union field _assignee.

_assignee can be only one of the following:
assignee

string

This can be a user or a @SocRole, default value is the default soc-role defined in Settings.

Union field _description.

_description can be only one of the following:
description

string

Case description. Limit chars to 1000.

Union field _type.

_type can be only one of the following:
type

enum (CaseType)

Case type

Union field _environment.

_environment can be only one of the following:
environment

string

Case environment.

Union field _move_environment.

_move_environment can be only one of the following:
moveEnvironment

object (MoveEnvironment)

Case environment move details.

Union field _score.

_score can be only one of the following:
score

number

Attack exposure score, how risky the case.

Union field _sla.

_sla can be only one of the following:
sla

object (Sla)

SLA for the case.

Union field _involved_suspicious_entity.

_involved_suspicious_entity can be only one of the following:
involvedSuspiciousEntity

boolean

If has involved suspicious entity in the case.

Union field _closure_details.

_closure_details can be only one of the following:
closureDetails

object (CaseClosureDetails)

Case closure details.

MoveEnvironment

JSON representation 
{
  "shouldDeleteOldCase": boolean
}
Fields
shouldDeleteOldCase

boolean

Optional. If the case should be deleted on move to the new environment.

Sla

JSON representation 
{
  "expirationTime": string,
  "criticalExpirationTime": string,
  "expirationStatus": enum (SlaExpirationStatus),
  "remainingTimeSinceLastPause": integer
}
Fields
expirationTime

string (int64 format)

Required. SLA expiration time in unix format as milliseconds. Old prop: SlaExpiration.
criticalExpirationTime

string (int64 format)

Required. SLA critical expiration time in unix format as milliseconds, old prop: SlaCriticalExpiration.
expirationStatus

enum (SlaExpirationStatus)

Output only. SLA expiration status.
remainingTimeSinceLastPause

integer

Output only. Remaining time since last pause.

CaseTag

JSON representation 
{
  "displayName": string,
  "alert": string,

  // Union field _priority can be only one of the following:
  "priority": integer
  // End of list of possible types for union field _priority.
}
Fields
displayName

string

Output only. The name of the tag
alert

string

Output only. For tags set by playbook action, this is relevant during MoveAlert. Replaces old property: "Indicator".

Union field _priority.

_priority can be only one of the following:
priority

integer

Output only. During ingestion if more than one tag matches the criteria, the one with the priority will be chosen. Available options: 1-5.

CaseProduct

JSON representation 
{
  "displayName": string,
  "alert": string
}
Fields
displayName

string

Output only. Display name of the product.
alert

string

Output only. Replaces old property: "AlertIdentifier".

CaseClosureDetails

JSON representation 
{
  "reason": enum (CloseReason),
  "rootCause": string,
  "caseClosedAction": enum (CaseClosedAction),
  "comment": string
}
Fields
reason

enum (CloseReason)

Output only. Case closure reason.
rootCause

string

Output only. Case closure root cause.
caseClosedAction

enum (CaseClosedAction)

Output only. Case closed action.
comment

string

Output only. Case closure comment.

Output Schema

This service is available for customers who migrated SOAR to a customer managed project and have the Chronicle API enabled. Cases provides analysts a way to investigate incoming security alerts and safeguard workstations. Cases are generated by alerts from the SIEM platform. Further alerts linked to the same entities may be grouped into an existing case based on a flexible configuration. In addition, analysts can create manual cases and simulated cases and ingest specific data.

Case

JSON representation 
{
  "name": string,
  "creatorUserId": string,
  "creatorUser": string,
  "lastModifyingUserId": string,
  "lastModifyingUser": string,
  "createTime": string,
  "updateTime": string,
  "displayName": string,
  "alertCount": integer,
  "stage": string,
  "priority": enum (Priority),
  "assignee": string,
  "assignedUser": string,
  "description": string,
  "type": enum (CaseType),
  "environment": string,
  "moveEnvironment": {
    object (MoveEnvironment)
  },
  "status": enum (CaseStatus),
  "score": number,
  "workflowStatus": enum (WorkflowStatus),
  "sla": {
    object (Sla)
  },
  "alertsSla": {
    object (Sla)
  },
  "source": string,
  "tags": [
    {
      object (CaseTag)
    }
  ],
  "products": [
    {
      object (CaseProduct)
    }
  ],
  "closureDetails": {
    object (CaseClosureDetails)
  },
  "tasks": [
    {
      object (Task)
    }
  ],

  // Union field _important can be only one of the following:
  "important": boolean
  // End of list of possible types for union field _important.

  // Union field _incident can be only one of the following:
  "incident": boolean
  // End of list of possible types for union field _incident.

  // Union field _overflow_case can be only one of the following:
  "overflowCase": boolean
  // End of list of possible types for union field _overflow_case.

  // Union field _involved_suspicious_entity can be only one of the following:
  "involvedSuspiciousEntity": boolean
  // End of list of possible types for union field _involved_suspicious_entity.
}
Fields
name

string

Identifier. The unique name(ID) of the Case. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}
creatorUserId

string

Output only. Case creator id. Used for homepage/requests feature.
creatorUser

string

Output only. Resource association for the creator.
lastModifyingUserId

string

Output only. Last user who modified the case. replaced old property name: LastModifyingUser.
lastModifyingUser

string

Output only. Resource association for the modifying user.
createTime

string (int64 format)

Output only. The creation time of the record in milliseconds.
updateTime

string (int64 format)

Output only. The modification time of the record in milliseconds.
displayName

string

Required. Case title, limited to 200 characters. Replaces old property: Title.
alertCount

integer

Output only. Alerts in case.
stage

string

Required. The stage of the Case. For example, "Triage", "Incident", "Investigation". Stages are defined in "chronicle.googleapis.com/CaseStageDefinition". The default stage option is "Triage".
priority

enum (Priority)

Required. Default value is HIGH. Case priority. For example, "Informative", "Low", "Medium", "High", "Critical".
assignee

string

Optional. This can be a user or a @SocRole, default value is the default soc-role defined in Settings.
assignedUser

string

Output only. Resource association for the assignee.
description

string

Optional. Case description. Limit chars to 1000.
type

enum (CaseType)

Required. Case type.
environment

string

Required. Case logical environments.
moveEnvironment

object (MoveEnvironment)

Optional. Case environment move details.
status

enum (CaseStatus)

Output only. Case data status.
score

number

Optional. Attack exposure score, how risky the case.
workflowStatus

enum (WorkflowStatus)

Output only. Case playbook status.
sla

object (Sla)

Optional. SLA for the case.
alertsSla

object (Sla)

Optional. Aggregated alerts SLA. (alert has SLA as well).
source

string

Output only. The source that created the case. Possible values: "Server", "User", "Simulated", "Merge", "AlertMove"
tags[]

object (CaseTag)

Optional. CaseTags associated with the case.
products[]

object (CaseProduct)

Optional. Products associated with the case. Contains Name of product (e.g. WinEventLog:Security/DLP_Product). Replaces old property: "Product".
closureDetails

object (CaseClosureDetails)

Optional. Case closure details.
tasks[]

object (Task)

Output only. Tasks associated with the case.

Union field _important.

_important can be only one of the following:
important

boolean

Optional. Additional way to specify case importance. The default is false.

Union field _incident.

_incident can be only one of the following:
incident

boolean

Optional. Additional way to specify if the case marked as incident. The default is false.

Union field _overflow_case.

_overflow_case can be only one of the following:
overflowCase

boolean

Output only. Case without events, was reduced by the connector service due to a large amount of data. During ingestion if the "alert package" crosses a specific threshold, the alert will be trimmed due to security reasons (DDOS attacks, etc..)

Union field _involved_suspicious_entity.

_involved_suspicious_entity can be only one of the following:
involvedSuspiciousEntity

boolean

Optional. If has involved suspicious entity in the case.

MoveEnvironment

JSON representation 
{
  "shouldDeleteOldCase": boolean
}
Fields
shouldDeleteOldCase

boolean

Optional. If the case should be deleted on move to the new environment.

Sla

JSON representation 
{
  "expirationTime": string,
  "criticalExpirationTime": string,
  "expirationStatus": enum (SlaExpirationStatus),
  "remainingTimeSinceLastPause": integer
}
Fields
expirationTime

string (int64 format)

Required. SLA expiration time in unix format as milliseconds. Old prop: SlaExpiration.
criticalExpirationTime

string (int64 format)

Required. SLA critical expiration time in unix format as milliseconds, old prop: SlaCriticalExpiration.
expirationStatus

enum (SlaExpirationStatus)

Output only. SLA expiration status.
remainingTimeSinceLastPause

integer

Output only. Remaining time since last pause.

CaseTag

JSON representation 
{
  "displayName": string,
  "alert": string,

  // Union field _priority can be only one of the following:
  "priority": integer
  // End of list of possible types for union field _priority.
}
Fields
displayName

string

Output only. The name of the tag
alert

string

Output only. For tags set by playbook action, this is relevant during MoveAlert. Replaces old property: "Indicator".

Union field _priority.

_priority can be only one of the following:
priority

integer

Output only. During ingestion if more than one tag matches the criteria, the one with the priority will be chosen. Available options: 1-5.

CaseProduct

JSON representation 
{
  "displayName": string,
  "alert": string
}
Fields
displayName

string

Output only. Display name of the product.
alert

string

Output only. Replaces old property: "AlertIdentifier".

CaseClosureDetails

JSON representation 
{
  "reason": enum (CloseReason),
  "rootCause": string,
  "caseClosedAction": enum (CaseClosedAction),
  "comment": string
}
Fields
reason

enum (CloseReason)

Output only. Case closure reason.
rootCause

string

Output only. Case closure root cause.
caseClosedAction

enum (CaseClosedAction)

Output only. Case closed action.
comment

string

Output only. Case closure comment.

Task

JSON representation 
{
  "name": string,
  "id": string,
  "createTime": string,
  "updateTime": string,
  "content": string,
  "dueTime": string,
  "title": string,
  "author": string,
  "lastAuthor": string,
  "assignee": string,
  "status": enum (Status),
  "resolver": string,
  "comment": string,
  "resolutionTime": string,
  "caseId": integer,

  // Union field _favorite can be only one of the following:
  "favorite": boolean
  // End of list of possible types for union field _favorite.
}
Fields
name

string

Identifier. The unique name(ID) of the task. Format: projects/{project}/locations/{location}/instances/{instance}/tasks/{task}
id

string (int64 format)

Output only. The unique ID of the task.
createTime

string (int64 format)

Output only. The creation time of the task.
updateTime

string (int64 format)

Output only. The last update time of the task.
content

string

Required. The task content, limited to 4096 characters.
dueTime

string (int64 format)

Optional. The due time for the task in ms. When specified during task creation, must be in the future. Is optional as deadlines can exist without a specific scheduled time.
title

string

Required. The task title, minimum length of 3 characters and maximum of 50 characters.
author

string

Output only. The user who created the task.
lastAuthor

string

Output only. The last editor of the task.
assignee

string

Required. The assignee of the task.
status

enum (Status)

Required. The status of the task. todo change to task startus enum
resolver

string

Output only. The user who resolved the task.
comment

string

Required. Comment added during task resolution, limited to 4096 characters.
resolutionTime

string (int64 format)

Output only. The resolution time of the task in ms.
caseId

integer (uint32 format)

Optional. Associated case id (if task is related to a specific case) Can be optional as tasks may exist independently or be associated with a specific case.

Union field _favorite.

_favorite can be only one of the following:
favorite

boolean

Optional. Determines whether the task is marked as favorite.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌