What is Mcp Secops V3

mcp-secops-v3 is an MCP (Model Context Protocol) server designed for interacting with Google’s Chronicle Security Operations API, enabling users to manage and analyze security events and alerts effectively.

Use cases

Use cases for mcp-secops-v3 include incident response, threat hunting, security monitoring, and compliance reporting, allowing security teams to efficiently manage and respond to security threats.

How to use

To use mcp-secops-v3, install Claude Desktop and configure it to recognize the MCP server by updating the ‘claude_desktop_config.json’ file with the appropriate paths and your Google Chronicle credentials. Then, run the server using the command ‘python main.py’.

Key features

Key features include searching security events, retrieving security alerts, looking up entity information (like IPs and domains), listing security detection rules, and obtaining Indicators of Compromise (IoCs) matches from Chronicle.

Where to use

mcp-secops-v3 is primarily used in cybersecurity operations, particularly for organizations utilizing Google Cloud’s Chronicle Security Operations suite to enhance their security posture.

This project is deprecated in favor of: https://github.com/google/mcp-security

Chronicle SecOps MCP Server

This is an MCP (Model Context Protocol) server for interacting with Google’s Chronicle Security Operations suite.
MCP Info

Installing in Claude Desktop

To use this MCP server with Claude Desktop:

1. Install Claude Desktop

2. Open Claude Desktop and select “Settings” from the Claude menu

3. Click on “Developer” in the lefthand bar, then click “Edit Config”

4. Update your claude_desktop_config.json with the following configuration (replace paths with your actual paths):

{
  "mcpServers": {
    "secops-mcp": {
      "command": "/path/to/your/uv",
      "args": [
        "--directory",
        "/path/to/your/mcp-secops-v3",
        "run",
        "secops_mcp.py"
      ],
      "env": {
        "CHRONICLE_PROJECT_ID": "your-google-cloud-project-id",
        "CHRONICLE_CUSTOMER_ID": "your-chronicle-customer-id",
        "CHRONICLE_REGION": "us"
      }
    }
  }
}

5. Make sure to update:

   • The path to uv (use which uv to find it)
   • The directory path to where this repository is cloned
   • Your Chronicle credentials (project ID, customer ID, and region)

6. Save the file and restart Claude Desktop

7. You should now see the hammer icon in the Claude Desktop interface, indicating the MCP server is active

Features

Security Tools

• search_security_events: Search for security events in Chronicle with customizable queries
• get_security_alerts: Get security alerts from Chronicle
• lookup_entity: Look up information about an entity (IP, domain, hash)
• list_security_rules: List security detection rules from Chronicle
• get_ioc_matches: Get Indicators of Compromise (IoCs) matches from Chronicle

Installation

Installing via Smithery

To install mcp-secops-v3 for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install @emeryray2002/mcp-secops-v3 --client claude

Manual Installation

1. Install the package:

pip install -e .

2. Set up your environment variables:

export CHRONICLE_PROJECT_ID="your-google-cloud-project-id"
export CHRONICLE_CUSTOMER_ID="your-chronicle-customer-id"
export CHRONICLE_REGION="us"  # or your region

Requirements

• Python 3.11+
• A Google Cloud account with Chronicle Security Operations enabled
• Proper authentication configured

Usage

Running the MCP Server

python main.py

API Capabilities

The MCP server provides the following capabilities:

1. Search Security Events: Search for security events in Chronicle
2. Get Security Alerts: Retrieve security alerts
3. Lookup Entity: Look up entity information (IP, domain, hash, etc.)
4. List Security Rules: List detection rules
5. Get IoC Matches: Get Indicators of Compromise matches

Example

See example.py for a complete example of using the MCP server.

Authentication

The server uses Google’s authentication. Make sure you have either:

1. Set up Application Default Credentials (ADC)
2. Set a GOOGLE_APPLICATION_CREDENTIALS environment variable
3. Used gcloud auth application-default login

License

Apache 2.0

Development

The project is structured as follows:

• secops_mcp.py: Main MCP server implementation
• example.py: Example usage of the MCP server