MCP Secops V3

🚀 Chronicle Security Operations MCP Server

This is a Model Context Protocol (MCP) server for interacting with Google's Chronicle Security Operations suite. MCP Information

🚀 Quick Start

Installation on Claude Desktop

To use this MCP server on the Claude desktop:

1. Install the Claude desktop application.
2. Open the Claude desktop application and select "Settings" from the menu.
3. Click "Developer" in the left sidebar, then click "Edit Configuration".
4. Update your claude_desktop_config.json file with the following configuration (replace the paths with your actual paths):

{
  "mcpServers": {
    "secops-mcp": {
      "command": "/path/to/your/uv",
      "args": [
        "--directory",
        "/path/to/your/mcp-secops-v3",
        "run",
        "secops_mcp.py"
      ],
      "env": {
        "CHRONICLE_PROJECT_ID": "Your Google Cloud project ID",
        "CHRONICLE_CUSTOMER_ID": "Your Chronicle customer ID",
        "CHRONICLE_REGION": "us"
      }
    }
  }
}

5. Ensure you update:
   • The path to uv (find it using which uv).
   • The directory path where this repository is located.
   • Your Chronicle credentials (project ID, customer ID, and region).
6. Save the file and restart the Claude desktop application.
7. You should now see a hammer icon in the Claude desktop interface, indicating that the MCP server is activated.

✨ Features

Security Tools

• search_security_events: Search for security events in Chronicle, supporting custom queries.
• get_security_alerts: Retrieve security alerts from Chronicle.
• lookup_entity: Look up entity information (IP, domain name, hash, etc.).
• list_security_rules: List Chronicle's security detection rules.
• get_ioc_matches: Get matches for Indicators of Compromise (IoCs).

📦 Installation

Installation via Smithery

To automatically install mcp-secops-v3 via Smithery:

npx -y @smithery/cli install @emeryray2002/mcp-secops-v3 --client claude

Manual Installation

1. Install the package:

pip install -e .

2. Set environment variables:

export CHRONICLE_PROJECT_ID="Your Google Cloud project ID"
export CHRONICLE_CUSTOMER_ID="Your Chronicle customer ID"
export CHRONICLE_REGION="us"  # Or your region

Requirements

• Python version 3.11 or higher.
• A Google Cloud account with Chronicle Security Operations enabled.
• Properly configured authentication.

💻 Usage Examples

Running the MCP Server

python main.py

API Functions

The MCP server provides the following functions:

1. Search for security events: Search for security events in Chronicle.
2. Retrieve security alerts: Get security alerts from Chronicle.
3. Look up entities: Look up entity information (IP, domain name, hash, etc.).
4. List security rules: List Chronicle's security detection rules.
5. Get IoC matches: Get matches for Indicators of Compromise (IoCs).