Skip to content
Get packs

Google SecOps Case Management

Lets an agent list, inspect, update, comment on, and close Google SecOps SOAR security cases.

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
2 files

What it does

Once installed, the agent can work with incident cases in Google Security Operations (a security operations platform). It can list cases, view details and linked alerts, add analyst notes, change priority or status, group alerts, and close cases with a root cause. It is instructed to treat case text as untrusted data, and to stop and report if the SecOps MCP server is not connected rather than working around it. The skill says it does not handle SIEM searches or detection rule authoring, and that remote MCP tools do not support case creation, so manual creation requires the local server or the SOAR UI.

Great for

  • Security analysts who triage and update SOAR cases through an AI agent
  • SOC teams already running the Google SecOps MCP server with valid credentials
  • Developers evaluating how to build guarded agent skills for security platforms

Skip it if

  • Teams without a Google SecOps tenant, since the skill cannot work without the MCP server and credentials
  • Hunting or searching raw logs with UDM queries, which the skill explicitly excludes
  • Unattended automation that closes or changes cases without human review, because it writes to live incident records

Try asking

  • “List open high-priority cases in my queue and summarise them in a table”
  • “Add a comment to case 4821 with the remediation steps we just completed”
  • “Show me the alerts and involved entities linked to this case before I close it”
  • “Update the priority of case 4821 to Critical and assign it to me”
Step-by-step guide: how to use Google SecOps Case ManagementInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the Apache-2.0 licence and an attribution note.

    secops-cases.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip secops-cases.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip secops-cases.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Confirm the MCP server shows as connected before starting, since tools are registered only at client startup
  • Review case changes before the agent closes or reassigns cases, as these write to live incident records
  • Pass explicit filters such as status and priority to keep list results manageable

What's inside

  • references/attribution.md
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.