Chronicle SecOps

关于

Chronicle SecOps acts as an MCP server, enabling interaction with Google's Chronicle Security Operations suite. It provides a bridge for querying and managing security events, alerts, entities, rules, and Indicators of Compromise (IoCs) within the Chronicle platform. The server is designed to be integrated with applications like Claude Desktop, allowing users to access Chronicle's security insights directly from their preferred environment.

主要功能

• List security detection rules from Chronicle.
• Retrieve security alerts from Chronicle.
• Look up information about security entities (IP, domain, hash).
• Get Indicators of Compromise (IoCs) matches from Chronicle.
• Search for security events in Chronicle with customizable queries.

使用案例

• Searching for specific security events based on customized criteria.
• Investigating security incidents by looking up entity information (IP addresses, domains, hashes).
• Retrieving and analyzing security alerts generated by Chronicle.