---
title: "Google Security Operations MCP server - actionlake"
description: "Give Claude 565 Google Security Operations actions through one MCP server: instance, cases. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/google-security-operations
updated: 2026-10-23
---

Connectors · Identity & security

# Google Security Operations MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Google Security Operations and the rest of your systems. It gives your agent 565 Google Security Operations actions (275 reads, 220 writes and 70 that wait for a confirmation) and holds the Google Security Operations credential itself, so the agent never does. It paces Google Security Operations's limits and records every call.

[Connect Google Security Operations free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "google_secops.cases.list",
  intent: "check which Google Security Operations account is connected"
}
# Cases: list · read · 1 upstream call
```

- 565 actions in one signed file
- 275 read look, never change
- 220 write create and update
- 70 wait for a yes destructive, confirmed first

Set up

## Connect Google Security Operations in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Google Security Operations.
   Signed token (JWT). You paste the signing key once; actionlake signs a short-lived token for each call. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `client_email` Service account client email (`client_email` in the JSON key file)
   - `private_key` Service account private key, PKCS#8 PEM (`private_key` in the JSON key file)
   - `host` Where your Google Security Operations lives: your host
   - `instance_id` Where your Google Security Operations lives: your instance id
   - `location` Your Google Security Operations location
   - `project_id` Your Google Security Operations project id
   ```
   account { op: "connections.requirements", service: "google_secops" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "google_secops.cases.list" }
   # cases: list · read · 1 upstream call
   check { action: "google_secops.case_comments.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Google Security Operations at a glance

**Sign-in**

Signed token (JWT). You paste the signing key once; actionlake signs a short-lived token for each call.

**You provide**

`client_email` `private_key`

**Setup fields**

`host` `instance_id` `location` `project_id`

**Limits we pace to**

5 calls a second, per connection

**API covered**

Chronicle API v1 (REST reference scraped 2026-10-23), at your Google Security Operations instance's API base URL, which you enter when connecting

**Built from**

Google Security Operations's documentation, read 23 October 2026[docs.cloud.google.com](https://docs.cloud.google.com/chronicle/docs/reference/rest) [GitHub](https://github.com/googleapis/googleapis/tree/master/google/cloud/chronicle/v1)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

275 of 275 reads, for up to 2 minutes; a write clears what it affects

**Shared entities**

2, so ask can line Google Security Operations up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Google Security Operations.

565 actions in 110 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **275** read look, never change
- **220** write create and update
- **70** destructive wait for a confirmation

1. ### Instance
   22
   20 read · 2 write · 0 destructive
   Instance: find entity · Instance: find entity alerts · Instance: find related entities · Instance: find udm field values
2. ### Cases
   18
   5 read · 13 write · 0 destructive
   Cases: list · Cases: get · Cases: patch · Cases: create insight
3. ### Remote agents
   16
   9 read · 6 write · 1 destructive
   Remote agents: create · Remote agents: list · Remote agents: send remote agent installer · Remote agents: connector valid remote agents
4. ### Integrations
   15
   9 read · 5 write · 1 destructive
   Integrations: create · Integrations: list · Integrations: download dependency · Integrations: fetch affected items
5. ### Data table rows
   12
   3 read · 8 write · 1 destructive
   Data table rows: bulk create · Data table rows: bulk create async · Data table rows: create · Data table rows: list
6. ### Native dashboards
   12
   3 read · 7 write · 2 destructive
   Native dashboards: list · Native dashboards: create · Native dashboards: get · Native dashboards: patch
7. ### Case alerts
   11
   5 read · 6 write · 0 destructive
   Case alerts: list · Case alerts: get · Case alerts: patch · Case alerts: create recommendation long running
8. ### Content packs
   10
   2 read · 7 write · 1 destructive
   Content packs: add · Content packs: deploy connector instances · Content packs: deploy playbooks · Content packs: deploy test cases

**102 more areas · 449 actions**

- Parsers **10**
- Feeds **9**
- Custom lists **8**
- Email templates **8**
- Integrations actions **8**
- Integrations connectors connector instances **8**
- Integrations integration instances **8**
- Rules **8**
- Soar networks **8**
- Case alert involved entities **7**
- Case queue filters **7**
- Dynamic parameters **7**
- Findings refinements **7**
- Integrations connectors **7**
- Integrations jobs **7**
- Log types **7**
- Ontology records visual families **7**
- Sla definitions **7**
- Soar domains **7**
- Case alert context properties **6**
- Case chat messages **6**
- Case context properties **6**
- Case tag definitions **6**
- Context properties **6**
- Environments **6**
- Integrations connectors context properties **6**
- Integrations jobs context properties **6**
- Integrations jobs job instances **6**
- Integrations managers **6**
- Alert grouping rules **5**
- Announcements **5**
- Case close definitions **5**
- Case comments **5**
- Case stage definitions **5**
- Data access labels **5**
- Data access scopes **5**
- Data exports **5**
- Data tables **5**
- Entities blocklists **5**
- Environment groups **5**
- Integrations managers revisions **5**
- Legacy soar users workdesk contacts **5**
- Legacy soar users workdesk links **5**
- Legacy soar users workdesk notes **5**
- Marketplace integrations **5**
- Module settings properties **5**
- Parser extensions **5**
- Property schema definitions **5**
- Request templates **5**
- Saved column sets **5**
- Soc roles **5**
- Tasks **5**
- Threat collections **5**
- Unique entities **5**
- Users saved column sets **5**
- Users search queries **5**
- Watchlists **5**
- Case wall records **4**
- Enrichment controls **4**
- Events **4**
- Integrations actions revisions **4**
- Integrations connectors revisions **4**
- Integrations jobs revisions **4**
- Iocs **4**
- Legacy soar users **4**
- Legacy soar users user notifications **4**
- Operations **4**
- Reference lists **4**
- System notifications **4**
- Views **4**
- Featured content native dashboards **3**
- Form dynamic parameters **3**
- Ioc associations **3**
- Legacy soar users attachments **3**
- Module settings **3**
- Retrohunts **3**
- Connector instance logs **2**
- Dashboard charts **2**
- Dashboard queries **2**
- Entities **2**
- Feed packs **2**
- Job instance logs **2**
- Log types logs **2**
- Parser extension extension validation reports **2**
- Big query export **1**
- Coverage details **1**
- Data table operation errors **1**
- Featured content rules **1**
- Feed service accounts **1**
- Feed source type schemas **1**
- Feed source type schemas log type schemas **1**
- Forwarders **1**
- Ingestion log labels **1**
- Ingestion log namespaces **1**
- Log types log type settings **1**
- Parser extension validation errors **1**
- Parser extension validation parsing errors **1**
- Parser extension validation reports **1**
- Parser validation parsing errors **1**
- Parser validation reports **1**
- Rule deployments **1**
- Rule execution errors **1**

Top actions

## The Google Security Operations API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 30 of Google Security Operations's 30 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `google_secops.case_alerts.list` Case alerts: list | Lists CaseAlerts within a specific Case. | read | `monitoring.alert.list` 51 connectors |
| `google_secops.cases.list` Cases: list | Lists Cases in an instance. | read | `monitoring.incident.list` 19 connectors |
| `google_secops.case_alerts.get` Case alerts: get | Gets a single CaseAlert. | read | `monitoring.alert.get` 33 connectors |
| `google_secops.cases.get` Cases: get | Gets a single Case by its resource name. | read | `monitoring.incident.get` 20 connectors |
| `google_secops.case_comments.create` Case comments: create | Creates a new CaseComment. | write | `monitoring.incident_note.create` 12 connectors |
| `google_secops.case_comments.list` Case comments: list | Lists CaseComments associated with a specific Case. | read | `monitoring.incident_note.list` 11 connectors |
| `google_secops.rules.list` Rules: list | Lists Rules. | read | `security.detection_rule.list` 13 connectors |
| `google_secops.rules.create` Rules: create | Creates a new Rule. | write | `security.detection_rule.create` 11 connectors |
| `google_secops.case_comments.delete` Case comments: delete | Performs a soft delete of a CaseComment. | destructive | `monitoring.incident_note.delete` 10 connectors |
| `google_secops.native_dashboards.list` Native dashboards: list | List all dashboards. | read | `analytics.dashboard.list` 22 connectors |
| `google_secops.native_dashboards.create` Native dashboards: create | Create a dashboard. | write | `analytics.dashboard.create` 18 connectors |
| `google_secops.entities_blocklists.create` Entities blocklists: create | Creates a new EntitiesBlocklist. | write | `security.block_list.create` 6 connectors |

Try it

## Prompts to paste into Claude.

Each one names the Google Security Operations actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Which Google Security Operations incidents are open, and how long has each been open?
   calls `google_secops.cases.list`
2. Write write
   Case comments: create in Google Security Operations. Show me exactly what you will send before you save it.
   calls `google_secops.case_comments.create`

Governance for Google Security Operations

## Destructive actions wait for a yes.

70 Google Security Operations actions are destructive. The first 10:

- Case comments: delete `google_secops.case_comments.delete`
- Rules: delete `google_secops.rules.delete`
- Native dashboards: delete `google_secops.native_dashboards.delete`
- Entities blocklists: delete `google_secops.entities_blocklists.delete`
- Feeds: delete `google_secops.feeds.delete`
- Parsers: delete `google_secops.parsers.delete`
- Watchlists: delete `google_secops.watchlists.delete`
- Data tables: delete `google_secops.data_tables.delete`
- Data table rows: delete `google_secops.data_table_rows.delete`
- Native dashboards: remove chart `google_secops.native_dashboards.remove_chart`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do google_secops.case_comments.delete confirm_policy: **human**

Case comments: delete?

**intent:** the user asked me to case comments: delete

run suspended · waiting for a named person · key _google-secops-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "google-secops-agent",
  allowed_actions: ["google_secops.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "google_secops.case_comments.delete", approver: "lead@example.com" },
    { match: "google_secops.rules.delete", approver: "lead@example.com" },
    { match: "google_secops.native_dashboards.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Google Security Operations only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Google Security Operations costs on actionlake.

Every Google Security Operations action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Google Security Operations refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 565 Google Security Operations actions
- 102 actions page each page of a long list is one call
- 275 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Google Security Operations action.

565 actions by area: the id your agent calls, what it does, and its effect.

**Instance 22**

- `google_secops.instance.find_entity` Instance: find entity read
- `google_secops.instance.find_entity_alerts` Instance: find entity alerts read
- `google_secops.instance.find_related_entities` Instance: find related entities read
- `google_secops.instance.find_udm_field_values` Instance: find udm field values read
- `google_secops.instance.compute_all_findings_refinement_activities` Instance: compute all findings refinement activities read
- `google_secops.instance.extract_syslog` Instance: extract syslog read
- and 16 more in this area

**Cases 18**

- `google_secops.cases.create_insight` Cases: create insight write
- `google_secops.cases.get` Cases: get read
- `google_secops.cases.list` Cases: list read
- `google_secops.cases.patch` Cases: patch write
- `google_secops.cases.add_tag` Cases: add tag write
- `google_secops.cases.execute_bulk_add_tag` Cases: execute bulk add tag write
- and 12 more in this area

**Remote agents 16**

- `google_secops.remote_agents.connector_valid_remote_agents` Remote agents: connector valid remote agents read
- `google_secops.remote_agents.create` Remote agents: create write
- `google_secops.remote_agents.list` Remote agents: list read
- `google_secops.remote_agents.send_remote_agent_installer` Remote agents: send remote agent installer write
- `google_secops.remote_agents.delete` Remote agents: delete destructive
- `google_secops.remote_agents.fetch_editable_remote_agents` Remote agents: fetch editable remote agents read
- and 10 more in this area

**Integrations 15**

- `google_secops.integrations.create` Integrations: create write
- `google_secops.integrations.download_dependency` Integrations: download dependency write
- `google_secops.integrations.fetch_affected_items` Integrations: fetch affected items read
- `google_secops.integrations.list` Integrations: list read
- `google_secops.integrations.delete` Integrations: delete destructive
- `google_secops.integrations.fetch_agent_integrations` Integrations: fetch agent integrations read
- and 9 more in this area

**Data table rows 12**

- `google_secops.data_table_rows.bulk_create` Data table rows: bulk create write
- `google_secops.data_table_rows.bulk_create_async` Data table rows: bulk create async write
- `google_secops.data_table_rows.create` Data table rows: create write
- `google_secops.data_table_rows.list` Data table rows: list read
- `google_secops.data_table_rows.bulk_get` Data table rows: bulk get read
- `google_secops.data_table_rows.bulk_replace` Data table rows: bulk replace write
- and 6 more in this area

**Native dashboards 12**

- `google_secops.native_dashboards.create` Native dashboards: create write
- `google_secops.native_dashboards.get` Native dashboards: get read
- `google_secops.native_dashboards.list` Native dashboards: list read
- `google_secops.native_dashboards.patch` Native dashboards: patch write
- `google_secops.native_dashboards.add_chart` Native dashboards: add chart write
- `google_secops.native_dashboards.delete` Native dashboards: delete destructive
- and 6 more in this area

**Case alerts 11**

- `google_secops.case_alerts.create_recommendation_long_running` Case alerts: create recommendation long running write
- `google_secops.case_alerts.get` Case alerts: get read
- `google_secops.case_alerts.list` Case alerts: list read
- `google_secops.case_alerts.patch` Case alerts: patch write
- `google_secops.case_alerts.fetch_recommendation` Case alerts: fetch recommendation read
- `google_secops.case_alerts.get_alert_overview_data` Case alerts: get alert overview data read
- and 5 more in this area

**Content packs 10**

- `google_secops.content_packs.add` Content packs: add write
- `google_secops.content_packs.deploy_connector_instances` Content packs: deploy connector instances write
- `google_secops.content_packs.deploy_playbooks` Content packs: deploy playbooks write
- `google_secops.content_packs.deploy_test_cases` Content packs: deploy test cases write
- `google_secops.content_packs.align_playbooks` Content packs: align playbooks write
- `google_secops.content_packs.delete` Content packs: delete destructive
- and 4 more in this area

**Parsers 10**

- `google_secops.parsers.activate` Parsers: activate write
- `google_secops.parsers.copy` Parsers: copy write
- `google_secops.parsers.create` Parsers: create write
- `google_secops.parsers.list` Parsers: list read
- `google_secops.parsers.activate_release_candidate_parser` Parsers: activate release candidate parser write
- `google_secops.parsers.deactivate` Parsers: deactivate write
- and 4 more in this area

**Feeds 9**

- `google_secops.feeds.create` Feeds: create write
- `google_secops.feeds.generate_secret` Feeds: generate secret write
- `google_secops.feeds.import_push_logs` Feeds: import push logs write
- `google_secops.feeds.list` Feeds: list read
- `google_secops.feeds.delete` Feeds: delete destructive
- `google_secops.feeds.disable` Feeds: disable write
- and 3 more in this area

**Custom lists 8**

- `google_secops.custom_lists.create` Custom lists: create write
- `google_secops.custom_lists.export` Custom lists: export read
- `google_secops.custom_lists.import` Custom lists: import write
- `google_secops.custom_lists.list` Custom lists: list read
- `google_secops.custom_lists.batch_delete` Custom lists: batch delete destructive
- `google_secops.custom_lists.delete` Custom lists: delete destructive
- and 2 more in this area

**Email templates 8**

- `google_secops.email_templates.create` Email templates: create write
- `google_secops.email_templates.export` Email templates: export read
- `google_secops.email_templates.import` Email templates: import write
- `google_secops.email_templates.list` Email templates: list read
- `google_secops.email_templates.batch_delete` Email templates: batch delete destructive
- `google_secops.email_templates.delete` Email templates: delete destructive
- and 2 more in this area

**Integrations actions 8**

- `google_secops.integrations_actions.create` Integrations actions: create write
- `google_secops.integrations_actions.execute_test` Integrations actions: execute test write
- `google_secops.integrations_actions.fetch_actions_by_environment` Integrations actions: fetch actions by environment read
- `google_secops.integrations_actions.list` Integrations actions: list read
- `google_secops.integrations_actions.delete` Integrations actions: delete destructive
- `google_secops.integrations_actions.fetch_template` Integrations actions: fetch template read
- and 2 more in this area

**Integrations connectors connector instances 8**

- `google_secops.integrations_connectors_connector_instances.create` Integrations connectors connector instances: create write
- `google_secops.integrations_connectors_connector_instances.fetch_latest_definition` Integrations connectors connector instances: fetch latest definition read
- `google_secops.integrations_connectors_connector_instances.get` Integrations connectors connector instances: get read
- `google_secops.integrations_connectors_connector_instances.list` Integrations connectors connector instances: list read
- `google_secops.integrations_connectors_connector_instances.delete` Integrations connectors connector instances: delete destructive
- `google_secops.integrations_connectors_connector_instances.patch` Integrations connectors connector instances: patch write
- and 2 more in this area

**Integrations integration instances 8**

- `google_secops.integrations_integration_instances.create` Integrations integration instances: create write
- `google_secops.integrations_integration_instances.execute_test` Integrations integration instances: execute test write
- `google_secops.integrations_integration_instances.fetch_affected_items` Integrations integration instances: fetch affected items read
- `google_secops.integrations_integration_instances.list` Integrations integration instances: list read
- `google_secops.integrations_integration_instances.delete` Integrations integration instances: delete destructive
- `google_secops.integrations_integration_instances.fetch_default_instance` Integrations integration instances: fetch default instance read
- and 2 more in this area

**Rules 8**

- `google_secops.rules.create` Rules: create write
- `google_secops.rules.get` Rules: get read
- `google_secops.rules.list` Rules: list read
- `google_secops.rules.patch` Rules: patch write
- `google_secops.rules.delete` Rules: delete destructive
- `google_secops.rules.get_deployment` Rules: get deployment read
- and 2 more in this area

**Soar networks 8**

- `google_secops.soar_networks.create` Soar networks: create write
- `google_secops.soar_networks.export` Soar networks: export read
- `google_secops.soar_networks.import` Soar networks: import write
- `google_secops.soar_networks.list` Soar networks: list read
- `google_secops.soar_networks.delete` Soar networks: delete destructive
- `google_secops.soar_networks.delete_all` Soar networks: delete all destructive
- and 2 more in this area

**Case alert involved entities 7**

- `google_secops.case_alert_involved_entities.add_property` Case alert involved entities: add property write
- `google_secops.case_alert_involved_entities.create` Case alert involved entities: create write
- `google_secops.case_alert_involved_entities.fetch_cards` Case alert involved entities: fetch cards read
- `google_secops.case_alert_involved_entities.list` Case alert involved entities: list read
- `google_secops.case_alert_involved_entities.get` Case alert involved entities: get read
- `google_secops.case_alert_involved_entities.patch` Case alert involved entities: patch write
- and 1 more in this area

**Case queue filters 7**

- `google_secops.case_queue_filters.create` Case queue filters: create write
- `google_secops.case_queue_filters.get` Case queue filters: get read
- `google_secops.case_queue_filters.get_share_config` Case queue filters: get share config read
- `google_secops.case_queue_filters.list` Case queue filters: list read
- `google_secops.case_queue_filters.delete` Case queue filters: delete destructive
- `google_secops.case_queue_filters.patch` Case queue filters: patch write
- and 1 more in this area

**Dynamic parameters 7**

- `google_secops.dynamic_parameters.create` Dynamic parameters: create write
- `google_secops.dynamic_parameters.export` Dynamic parameters: export read
- `google_secops.dynamic_parameters.import` Dynamic parameters: import write
- `google_secops.dynamic_parameters.list` Dynamic parameters: list read
- `google_secops.dynamic_parameters.delete` Dynamic parameters: delete destructive
- `google_secops.dynamic_parameters.get` Dynamic parameters: get read
- and 1 more in this area

**Findings refinements 7**

- `google_secops.findings_refinements.compute_findings_refinement_activity` Findings refinements: compute findings refinement activity read
- `google_secops.findings_refinements.create` Findings refinements: create write
- `google_secops.findings_refinements.get` Findings refinements: get read
- `google_secops.findings_refinements.list` Findings refinements: list read
- `google_secops.findings_refinements.get_deployment` Findings refinements: get deployment read
- `google_secops.findings_refinements.patch` Findings refinements: patch write
- and 1 more in this area

**Integrations connectors 7**

- `google_secops.integrations_connectors.create` Integrations connectors: create write
- `google_secops.integrations_connectors.execute_test` Integrations connectors: execute test write
- `google_secops.integrations_connectors.fetch_template` Integrations connectors: fetch template read
- `google_secops.integrations_connectors.list` Integrations connectors: list read
- `google_secops.integrations_connectors.delete` Integrations connectors: delete destructive
- `google_secops.integrations_connectors.get` Integrations connectors: get read
- and 1 more in this area

**Integrations jobs 7**

- `google_secops.integrations_jobs.create` Integrations jobs: create write
- `google_secops.integrations_jobs.execute_test` Integrations jobs: execute test write
- `google_secops.integrations_jobs.fetch_template` Integrations jobs: fetch template read
- `google_secops.integrations_jobs.list` Integrations jobs: list read
- `google_secops.integrations_jobs.delete` Integrations jobs: delete destructive
- `google_secops.integrations_jobs.get` Integrations jobs: get read
- and 1 more in this area

**Log types 7**

- `google_secops.log_types.create` Log types: create write
- `google_secops.log_types.generate_event_types_suggestions` Log types: generate event types suggestions read
- `google_secops.log_types.legacy_submit_parser_extension` Log types: legacy submit parser extension write
- `google_secops.log_types.list` Log types: list read
- `google_secops.log_types.get_log_type_setting` Log types: get log type setting read
- `google_secops.log_types.run_parser` Log types: run parser read
- and 1 more in this area

**Ontology records visual families 7**

- `google_secops.ontology_records_visual_families.create` Ontology records visual families: create write
- `google_secops.ontology_records_visual_families.export` Ontology records visual families: export read
- `google_secops.ontology_records_visual_families.import` Ontology records visual families: import write
- `google_secops.ontology_records_visual_families.list` Ontology records visual families: list read
- `google_secops.ontology_records_visual_families.delete` Ontology records visual families: delete destructive
- `google_secops.ontology_records_visual_families.get` Ontology records visual families: get read
- and 1 more in this area

**Sla definitions 7**

- `google_secops.sla_definitions.create` Sla definitions: create write
- `google_secops.sla_definitions.export` Sla definitions: export read
- `google_secops.sla_definitions.import` Sla definitions: import write
- `google_secops.sla_definitions.list` Sla definitions: list read
- `google_secops.sla_definitions.delete` Sla definitions: delete destructive
- `google_secops.sla_definitions.get` Sla definitions: get read
- and 1 more in this area

**Soar domains 7**

- `google_secops.soar_domains.create` Soar domains: create write
- `google_secops.soar_domains.export` Soar domains: export read
- `google_secops.soar_domains.import` Soar domains: import write
- `google_secops.soar_domains.list` Soar domains: list read
- `google_secops.soar_domains.delete` Soar domains: delete destructive
- `google_secops.soar_domains.get` Soar domains: get read
- and 1 more in this area

**Case alert context properties 6**

- `google_secops.case_alert_context_properties.clear_all` Case alert context properties: clear all destructive
- `google_secops.case_alert_context_properties.create` Case alert context properties: create write
- `google_secops.case_alert_context_properties.get` Case alert context properties: get read
- `google_secops.case_alert_context_properties.list` Case alert context properties: list read
- `google_secops.case_alert_context_properties.delete` Case alert context properties: delete destructive
- `google_secops.case_alert_context_properties.patch` Case alert context properties: patch write

**Case chat messages 6**

- `google_secops.case_chat_messages.create` Case chat messages: create write
- `google_secops.case_chat_messages.get` Case chat messages: get read
- `google_secops.case_chat_messages.list` Case chat messages: list read
- `google_secops.case_chat_messages.pin_message` Case chat messages: pin message write
- `google_secops.case_chat_messages.unpin_message` Case chat messages: unpin message write
- `google_secops.case_chat_messages.unread_messages_count` Case chat messages: unread messages count read

**Case context properties 6**

- `google_secops.case_context_properties.clear_all` Case context properties: clear all destructive
- `google_secops.case_context_properties.create` Case context properties: create write
- `google_secops.case_context_properties.get` Case context properties: get read
- `google_secops.case_context_properties.list` Case context properties: list read
- `google_secops.case_context_properties.delete` Case context properties: delete destructive
- `google_secops.case_context_properties.patch` Case context properties: patch write

Case tag definitions **6** Context properties **6** Environments **6** Integrations connectors context properties **6** Integrations jobs context properties **6** Integrations jobs job instances **6** Integrations managers **6** Alert grouping rules **5** Announcements **5** Case close definitions **5** Case comments **5** Case stage definitions **5** Data access labels **5** Data access scopes **5** Data exports **5** Data tables **5** Entities blocklists **5** Environment groups **5** Integrations managers revisions **5** Legacy soar users workdesk contacts **5** Legacy soar users workdesk links **5** Legacy soar users workdesk notes **5** Marketplace integrations **5** Module settings properties **5** Parser extensions **5** Property schema definitions **5** Request templates **5** Saved column sets **5** Soc roles **5** Tasks **5** Threat collections **5** Unique entities **5** Users saved column sets **5** Users search queries **5** Watchlists **5** Case wall records **4** Enrichment controls **4** Events **4** Integrations actions revisions **4** Integrations connectors revisions **4** Integrations jobs revisions **4** Iocs **4** Legacy soar users **4** Legacy soar users user notifications **4** Operations **4** Reference lists **4** System notifications **4** Views **4** Featured content native dashboards **3** Form dynamic parameters **3** Ioc associations **3** Legacy soar users attachments **3** Module settings **3** Retrohunts **3** Connector instance logs **2** Dashboard charts **2** Dashboard queries **2** Entities **2** Feed packs **2** Job instance logs **2** Log types logs **2** Parser extension extension validation reports **2** Big query export **1** Coverage details **1** Data table operation errors **1** Featured content rules **1** Feed service accounts **1** Feed source type schemas **1** Feed source type schemas log type schemas **1** Forwarders **1** Ingestion log labels **1** Ingestion log namespaces **1** Log types log type settings **1** Parser extension validation errors **1** Parser extension validation parsing errors **1** Parser extension validation reports **1** Parser validation parsing errors **1** Parser validation reports **1** Rule deployments **1** Rule execution errors **1**

This index shows a sample of each area. All 565 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search.

Questions

## The Google Security Operations MCP server, answered.

**Is there a Google Security Operations MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 565 Google Security Operations actions across instance, cases, remote agents and integrations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Google Security Operations.

**What do I need to connect Google Security Operations?**

Service account client email (`client_email` in the JSON key file) and Service account private key, PKCS#8 PEM (`private_key` in the JSON key file). Plus your host, your instance id, your location and your project id. The free call account { op: "connections.requirements", service: "google_secops" } lists exactly what to paste.

**Can an AI agent delete or change things in Google Security Operations?**

Only if its key allows it, and only with an explicit confirmation. 70 Google Security Operations actions are destructive, including case comments: delete, rules: delete and native dashboards: delete. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Google Security Operations API limit?**

actionlake paces every call to the limits in the Google Security Operations service file: 5 calls a second per connection. Repeated reads are answered from cache (275 Google Security Operations actions can be), which never reaches Google Security Operations.

**What does a Google Security Operations action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (102 Google Security Operations actions page). Cache hits, searches, dry runs and calls Google Security Operations refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Google Security Operations API does it cover?**

The Chronicle API v1 (REST reference scraped 2026-10-23) at your Google Security Operations instance's API base URL, which you enter when connecting. It is built from Google Security Operations's documentation as read on 23 October 2026. 565 actions in 110 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my Google Security Operations data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 2 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Google Security Operations credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Google Security Operations

Shares the most action names with

- [JumpCloud 10](https://actionlake.com/connectors/jumpcloud)
- [Google Security Command Center 5](https://actionlake.com/connectors/google-security-command-center)
- [Sekoia.io 5](https://actionlake.com/connectors/sekoia-io)
- [Panther 4](https://actionlake.com/connectors/panther)
- [Rapid7 InsightIDR 4](https://actionlake.com/connectors/rapid7-insightidr)
- [VulnCheck 2](https://actionlake.com/connectors/vulncheck)

Joins with, on shared entities

- [Dynatrace 2](https://actionlake.com/connectors/dynatrace)
- [Rootly 2](https://actionlake.com/connectors/rootly)
- [FireHydrant 2](https://actionlake.com/connectors/firehydrant)
- [PagerDuty 2](https://actionlake.com/connectors/pagerduty)
- [incident.io 2](https://actionlake.com/connectors/incident-io)
- [Acronis Cyber Protect Cloud 2](https://actionlake.com/connectors/acronis-cyber-protect-cloud)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Google Security Operations; the name is the vendor's own. Counts are from the Google Security Operations service file, version 1.0.0.

## Give your agent Google Security Operations today.

[Connect Google Security Operations free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/google-security-operations
More: https://actionlake.com/llms.txt