MCP Tools Reference: chronicle.googleapis.com

Tool: `update_case_alert`

Updates an existing case alert in Google SecOps.

This function modifies the priority, status, or closure_details of a specific alert within a case.

Workflow Integration: - A core function for managing the lifecycle of an alert, used in both manual and automated workflows. - Integrates with UI actions for changing an alert's priority, status (e.g., open, closed), or closing it with details. - Essential for automated playbooks that need to programmatically update an alert's state, such as escalating priority based on new findings or closing an alert after remediation. - Can be used to synchronize alert status and details with external ticketing or project management systems.

Use Cases: - A playbook automatically updates an alert's status to 'CLOSE' and sets closure_details with a reason of 'NOT_MALICIOUS' after automated analysis. - An analyst manually changes the priority of an alert to 'HIGH' based on their assessment. - An analyst updates the status to 'OPEN' to indicate they are actively investigating. - A SOC manager updates the closure_details for a set of related alerts after a breach investigation is complete.

Args: project_id (str): Google Cloud project ID (required). customer_id (str): Chronicle customer ID (required). region (str): Chronicle region (e.g., "us", "europe") (required). case_id (str): The numeric ID of the parent case containing the alert (e.g., '12345'). case_alert_id (str): The numeric ID of the alert to update (e.g., '12345'). Do NOT use the alert title or identifier string. priority (google.cloud.chronicle.v1alpha.LegacyCasePriority, optional): The new priority for the alert. Possible values are: - UNCHANGED - INFORMATIVE - LOW - MEDIUM - HIGH - CRITICAL status (google.cloud.chronicle.v1alpha.AlertStatus, optional): The new status for the alert. Possible values are: - OPEN - CLOSE closure_details (google.cloud.chronicle.v1alpha.AlertClosureDetails, optional): The closure details object. Providing this typically accompanies setting the status to CLOSE. - reason (enum): The reason for closing the alert (required). One of: - MALICIOUS - NOT_MALICIOUS - MAINTENANCE - INCONCLUSIVE - UNKNOWN - root_cause (str): The root cause of the alert (required). - comment (str): A comment about the alert. Optional.

Returns: CaseAlert: The updated CaseAlert object with the new values. The CaseAlert object contains the following key fields: - Name (str): The full resource name of the alert. - Id (int): The unique identifier for the alert. - DisplayName (str): The title or display name of the alert. - Priority (str): The priority of the alert (e.g., "HIGH"). - Status (str): The current status of the alert (e.g., "OPEN"). - CreateTime (int): The creation timestamp of the alert in milliseconds. - UpdateTime (int): The last update timestamp of the alert in milliseconds. - Product (str): The product that generated the alert. - Vendor (str): The vendor of the product that generated the alert. - RuleGenerator (str): The rule that generated the alert. Returns an error message if the alert is not found, the user lacks permission, or the update is invalid.

Example Usage: # Close a case alert as 'NOT_MALICIOUS' with a comment update_case_alert( project_id='123', region='us', customer_id='abc', case_id='456', case_alert_id='789', status='CLOSE', closure_details={ 'reason': 'NOT_MALICIOUS', 'root_cause': 'Benign activity verified', 'comment': 'Verified benign.' } )

# Update the priority of a case alert update_case_alert( project_id='123', region='us', customer_id='abc', case_id='456', case_alert_id='789', priority='HIGH' )

# Re-open an alert update_case_alert( project_id='123', region='us', customer_id='abc', case_id='456', case_alert_id='789', status='OPEN' )

Next Steps (using MCP-enabled tools): - Use 'get_case_alert' with the alert's resource name to verify that the alert has been updated correctly. - Use 'create_case_comment' to add a note to the parent case explaining why the alert was changed. - Use 'list_case_alerts' to see the updated status of the alert in the context of other alerts in the case.

The following sample demonstrate how to use curl to invoke the update_case_alert MCP tool.

Curl Request
curl --location 'https://chronicle.googleapis.com/mcp' \ --header 'content-type: application/json' \ --header 'accept: application/json, text/event-stream' \ --data '{ "method": "tools/call", "params": { "name": "update_case_alert", "arguments": { // provide these details according to the tool's MCP specification } }, "jsonrpc": "2.0", "id": 1 }'

Curl Request

                  
curl --location 'https://chronicle.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "update_case_alert",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for UpdateCaseAlert. Next ID: 10

UpdateCaseAlertRequest

JSON representation

JSON representation
{ "projectId": string, "customerId": string, "region": string, "caseId": string, "caseAlertId": string, // Union field `_priority` can be only one of the following: "priority": enum (`LegacyCasePriority`) // End of list of possible types for union field `_priority`. // Union field `_status` can be only one of the following: "status": enum (`AlertStatus`) // End of list of possible types for union field `_status`. // Union field `_closure_details` can be only one of the following: "closureDetails": { object (`AlertClosureDetails`) } // End of list of possible types for union field `_closure_details`. }

{
  "projectId": string,
  "customerId": string,
  "region": string,
  "caseId": string,
  "caseAlertId": string,

  // Union field _priority can be only one of the following:
  "priority": enum (LegacyCasePriority)
  // End of list of possible types for union field _priority.

  // Union field _status can be only one of the following:
  "status": enum (AlertStatus)
  // End of list of possible types for union field _status.

  // Union field _closure_details can be only one of the following:
  "closureDetails": {
    object (AlertClosureDetails)
  }
  // End of list of possible types for union field _closure_details.
}

Fields

Fields
`projectId`	`string` Project ID of the customer.
`customerId`	`string` Customer ID of the customer.
`region`	`string` Region of the customer.
`caseId`	`string` Case ID.
`caseAlertId`	`string` Case alert ID.
Union field `_priority`. `_priority` can be only one of the following:
`priority`	`enum (LegacyCasePriority)` Alert Priority.
Union field `_status`. `_status` can be only one of the following:
`status`	`enum (AlertStatus)` Alert status. Changed this line
Union field `_closure_details`. `_closure_details` can be only one of the following:
`closureDetails`	`object (AlertClosureDetails)` Alert closure details.

projectId

string

Project ID of the customer.

customerId

string

Customer ID of the customer.

region

string

Region of the customer.

caseId

string

Case ID.

caseAlertId

string

Case alert ID.

Union field _priority.

_priority can be only one of the following:

priority

enum (LegacyCasePriority)

Alert Priority.

Union field _status.

_status can be only one of the following:

status

enum (AlertStatus)

Alert status. Changed this line

Union field _closure_details.

_closure_details can be only one of the following:

closureDetails

object (AlertClosureDetails)

Alert closure details.

AlertClosureDetails

JSON representation
{ "reason": enum (`CloseReason`), "comment": string, "rootCause": string, "closingTimeMs": string }

Fields
`reason`	`enum (CloseReason)` Output only. Alert closure reason.
`comment`	`string` Output only. Alert closure comment.
`rootCause`	`string` Output only. Alert closure root cause.
`closingTimeMs`	`string (int64 format)` Output only. Alert closure time in unix format as milliseconds.

Output Schema

This service is available for customers who migrated SOAR to a customer managed project and have the Chronicle API enabled. Alerts are tied to data identified as a threat by your security systems. Investigating alerts gives you context about the alert and related entities.

CaseAlert

JSON representation

JSON representation
{ "name": string, "identifier": string, "caseId": integer, "createTime": string, "updateTime": string, "ruleGenerator": string, "sourceGroupingIdentifier": string, "product": string, "displayName": string, "vendor": string, "environment": string, "ticketId": string, "sourceSystemName": string, "closureDetails": { object (`AlertClosureDetails`) }, "sla": { object (`Sla`) }, "manual": boolean, "priority": enum (`LegacyCasePriority`), "sourceIdentifier": string, "additionalProperties": string, "status": enum (`AlertStatus`), "startTime": string, "endTime": string, "involvedRelations": [ { object (`InvolvedRelation`) } ], "siemAlertId": string, "sourceUrl": string, "sourceRuleUrl": string, "sourceSystemUrl": string, "sourceRuleIdentifier": string, "playbookStatus": enum (`WorkflowStatus`), "attachedPlaybookName": string, "nestingDepth": integer, "alertGroupIdentifier": string, "eventCount": integer, // Union field `_playbook_run_count` can be only one of the following: "playbookRunCount": integer // End of list of possible types for union field `_playbook_run_count`. }

{
  "name": string,
  "identifier": string,
  "caseId": integer,
  "createTime": string,
  "updateTime": string,
  "ruleGenerator": string,
  "sourceGroupingIdentifier": string,
  "product": string,
  "displayName": string,
  "vendor": string,
  "environment": string,
  "ticketId": string,
  "sourceSystemName": string,
  "closureDetails": {
    object (AlertClosureDetails)
  },
  "sla": {
    object (Sla)
  },
  "manual": boolean,
  "priority": enum (LegacyCasePriority),
  "sourceIdentifier": string,
  "additionalProperties": string,
  "status": enum (AlertStatus),
  "startTime": string,
  "endTime": string,
  "involvedRelations": [
    {
      object (InvolvedRelation)
    }
  ],
  "siemAlertId": string,
  "sourceUrl": string,
  "sourceRuleUrl": string,
  "sourceSystemUrl": string,
  "sourceRuleIdentifier": string,
  "playbookStatus": enum (WorkflowStatus),
  "attachedPlaybookName": string,
  "nestingDepth": integer,
  "alertGroupIdentifier": string,
  "eventCount": integer,

  // Union field _playbook_run_count can be only one of the following:
  "playbookRunCount": integer
  // End of list of possible types for union field _playbook_run_count.
}

Fields
`name`	`string` Identifier. The unique name(ID) of the CaseAlert. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}/caseAlerts/{case_alert}
`identifier`	`string` Output only. Title + Guid, e.g. ACCESS DISABLED ACCOUNTS_3A0C90F9-A87E-4E94-8727-7884F686ECDA Legacy identifier of alert used across the legacy modules in the system. Char limit: 2100
`caseId`	`integer` Output only. Case associated with the alert. Added for convenience to be used by the UI.
`createTime`	`string (int64 format)` Output only. The creation time of the record in milliseconds.
`updateTime`	`string (int64 format)` Output only. The modification time of the record in milliseconds.
`ruleGenerator`	`string` Output only. Which rule triggered the alert on the third party. This can be any rule defined in the third party Such SIEM, Splunk, CrowdStrike. Characters limit: 250.
`sourceGroupingIdentifier`	`string` Output only. A key on the alert that can be used to group alerts to the same case. Characters limit: 2100
`product`	`string` Output only. The product associated with the alert. E.g. DLP, WinEventLog:Security
`displayName`	`string` Output only. The display name of the alert. E.g. "DATA EXFILTRATION"
`vendor`	`string` Output only. The vendor of the alert. E.g. "Microsoft". Characters limit: 2100
`environment`	`string` Output only. The environment of the alert.
`ticketId`	`string` Output only. Third party ticket id, can be originated from SIEM or other tools. E.g. "3a0c90f9-a87e-4e94-8727-7884f686ecda"
`sourceSystemName`	`string` Output only. Which alerting system raises the alert. E.g. "QRadar", "Arcsight", "Microsoft CASB". The Integration Name in soar.
`closureDetails`	`object (AlertClosureDetails)` Optional. Defines the close reason of an alert if any.
`sla`	`object (Sla)` Optional. SLA (Service Level Agreement) for the specific alert, used also to calculate aggregate case sla.
`manual`	`boolean` Output only. Whether the alert was created manually.
`priority`	`enum (LegacyCasePriority)` Optional. Default value is HIGH.
`sourceIdentifier`	`string` Output only. Stores the identifier of the source of the alert, could be a connector identifier etc.
`additionalProperties`	`string` Output only. Stores additional data on specific alerts, currently used by connectors, in JSON format.
`status`	`enum (AlertStatus)` Optional. Alert status. Default value is OPEN.
`startTime`	`string (int64 format)` Output only. When the alert was created on the third party product (SIEM, IPS, etc).
`endTime`	`string (int64 format)` Output only. When the alert was closed on the third party product (SIEM, IPS, etc).
`involvedRelations[]`	`object (InvolvedRelation)` Output only. All involved relations for the alert. Directional connection between entities in a given alert.
`siemAlertId`	`string` Output only. The identifier of the alert int SIEM.
`sourceUrl`	`string` Output only. The source URL of the alert.
`sourceRuleUrl`	`string` Output only. The source rule URL of the alert.
`sourceSystemUrl`	`string` Output only. The source system URL.
`sourceRuleIdentifier`	`string` Output only. The source rule identifier.
`playbookStatus`	`enum (WorkflowStatus)` Output only. Alert playbook status.
`attachedPlaybookName`	`string` Output only. The attached playbook name.
`nestingDepth`	`integer` Output only. The nesting depth of the alert.
`alertGroupIdentifier`	`string` Output only. The alert group identifier.
`eventCount`	`integer` Output only. The number of events that triggered the alert.
Union field `_playbook_run_count`. `_playbook_run_count` can be only one of the following:
`playbookRunCount`	`integer` Output only. The number of times the first playbook was run on the alert.

AlertClosureDetails

JSON representation
{ "reason": enum (`CloseReason`), "comment": string, "rootCause": string, "closingTimeMs": string }

Fields
`reason`	`enum (CloseReason)` Output only. Alert closure reason.
`comment`	`string` Output only. Alert closure comment.
`rootCause`	`string` Output only. Alert closure root cause.
`closingTimeMs`	`string (int64 format)` Output only. Alert closure time in unix format as milliseconds.

Sla

JSON representation
{ "expirationTime": string, "criticalExpirationTime": string, "expirationStatus": enum (`SlaExpirationStatus`), "remainingTimeSinceLastPause": integer }

Fields
`expirationTime`	`string (int64 format)` Required. SLA expiration time in unix format as milliseconds. Old prop: SlaExpiration.
`criticalExpirationTime`	`string (int64 format)` Required. SLA critical expiration time in unix format as milliseconds, old prop: SlaCriticalExpiration.
`expirationStatus`	`enum (SlaExpirationStatus)` Output only. SLA expiration status.
`remainingTimeSinceLastPause`	`integer` Output only. Remaining time since last pause.

InvolvedRelation

JSON representation

JSON representation
{ "identifier": string, "alertIdentifier": string, "caseId": integer, "relationType": string, "from": { object (`EntityKey`) }, "to": { object (`EntityKey`) }, "deviceProduct": string, "deviceVendor": string, "categoryOutcome": string, "destinationPort": string, "eventClassId": string, "startTime": string, "endTime": string, "additionalProperties": string }

{
  "identifier": string,
  "alertIdentifier": string,
  "caseId": integer,
  "relationType": string,
  "from": {
    object (EntityKey)
  },
  "to": {
    object (EntityKey)
  },
  "deviceProduct": string,
  "deviceVendor": string,
  "categoryOutcome": string,
  "destinationPort": string,
  "eventClassId": string,
  "startTime": string,
  "endTime": string,
  "additionalProperties": string
}

Fields
`identifier`	`string` Required. The identifier of the relation.
`alertIdentifier`	`string` Output only. The identifier of the alert the relation belongs to.
`caseId`	`integer` Output only. The id of the case the relation belongs to.
`relationType`	`string` Output only. The type of the relation.
`from`	`object (EntityKey)` Output only. The source of the relation.
`to`	`object (EntityKey)` Output only. The destination of the relation.
`deviceProduct`	`string` Output only. The product.
`deviceVendor`	`string` Output only. The vendor.
`categoryOutcome`	`string` Output only. The category outcome. Blocked/Allowed/null.
`destinationPort`	`string` Output only. The destination port, if relevant
`eventClassId`	`string` Output only. Event display name. For example: Email Check, Data Exfiltration, IRC etc.
`startTime`	`string (int64 format)` Output only. Start time of the involved relation.
`endTime`	`string (int64 format)` Output only. End time of the involved relation.
`additionalProperties`	`string` Output only. Additional data, stored in JSON format.

EntityKey

JSON representation
{ "identifier": string, "type": string }

Fields

Fields
`identifier`	`string` Output only. The identifier of the entity.
`type`	`string` Output only. The type of the entity.

identifier

string

Output only. The identifier of the entity.

type

string

Output only. The type of the entity.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌

MCP Tools Reference: chronicle.googleapis.com Stay organized with collections Save and categorize content based on your preferences.

Tool: update_case_alert

Input Schema

UpdateCaseAlertRequest

AlertClosureDetails

Output Schema

CaseAlert

AlertClosureDetails

Sla

InvolvedRelation

EntityKey

Tool Annotations

MCP Tools Reference: chronicle.googleapis.com

Tool: `update_case_alert`