Keep Google SecOps cases and investigation notes current.
What it does
Manages security incident cases and records investigation findings in Google Security Operations.
When to use it
Use for listing, creating, inspecting, updating, or closing SOAR cases, recording investigation notes, and grouping alerts, not SIEM searches or detection-rule authoring.
How to use it
Give it a case-management request; it retrieves or changes incident cases in the configured Google SecOps tenant.
Uses
Good to know
- cannot be undone: Google Security Operations
What you need · 2
Requires a connected Google SecOps MCP server with list_cases registered; prefers the remote server over registered local equivalents.
Requires valid credentials to connect the MCP server when starting the client; their type and source are not specified.
Access · 1
This skill
Google Security Operations
Updates and closes security cases (irreversible)