---
title: "Google SecOps SOAR"
description: "Reference for the Tracecat Google SecOps SOAR integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Add case tag

Action ID: `tools.google_secops_soar.add_case_tag`

Add a tag to a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_id" type="integer" required>

The case ID

</ParamField>

<ParamField path="tag" type="string" required>

Tag to add to the case

</ParamField>

<ParamField path="alert_identifier" type="string | null">

Optional alert identifier within the case

Default: `null`.

</ParamField>

## Assign user to case

Action ID: `tools.google_secops_soar.assign_user_to_case`

Assign a user or SOC role to a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_id" type="integer" required>

The case ID

</ParamField>

<ParamField path="user_id" type="string" required>

User ID (GUID) or @RoleName to assign

</ParamField>

<ParamField path="alert_identifier" type="string | null">

Optional alert identifier within the case

Default: `null`.

</ParamField>

## Bulk close cases

Action ID: `tools.google_secops_soar.bulk_close_cases`

Close multiple Chronicle SOAR cases in a single operation.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_ids" type="array[integer]" required>

List of case IDs to close

</ParamField>

<ParamField path="close_comment" type="string" required>

Comment for all closed cases

</ParamField>

<ParamField path="close_reason" type="integer" required>

Close reason enum: 0=Malicious, 1=NotMalicious, 2=Maintenance, 3=Inconclusive, 4=Unknown

</ParamField>

<ParamField path="root_cause" type="string" required>

Root cause description

</ParamField>

## Change case stage

Action ID: `tools.google_secops_soar.change_case_stage`

Change the stage of a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_id" type="integer" required>

The case ID

</ParamField>

<ParamField path="stage" type="string" required>

New stage: Triage, Assessment, Investigation, Incident, Improvement, or Research

</ParamField>

## Close alert

Action ID: `tools.google_secops_soar.close_alert`

Close a specific alert within a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="alert_identifier" type="string" required>

The alert identifier to close

</ParamField>

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="comment" type="string" required>

Comment explaining why the alert is being closed

</ParamField>

<ParamField path="reason" type="string" required>

Close reason: Malicious, NotMalicious, Maintenance, or Inconclusive

</ParamField>

<ParamField path="root_cause" type="string" required>

Root cause description

</ParamField>

<ParamField path="source_case_id" type="integer" required>

The case ID where the alert is being closed

</ParamField>

<ParamField path="usefulness" type="string">

Alert usefulness: None, NotUseful, or Useful

Default: `"None"`.

</ParamField>

## Create case comment

Action ID: `tools.google_secops_soar.create_case_comment`

Add a comment to a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_id" type="integer" required>

The case ID

</ParamField>

<ParamField path="comment" type="string" required>

Comment text to add to the case

</ParamField>

<ParamField path="alert_identifier" type="string | null">

Optional alert identifier

Default: `null`.

</ParamField>

<ParamField path="base64_blob" type="string | null">

Optional base64-encoded file content

Default: `null`.

</ParamField>

<ParamField path="file_name" type="string | null">

Optional attachment filename

Default: `null`.

</ParamField>

<ParamField path="file_type" type="string | null">

Optional file type (e.g., '.pdf', '.txt')

Default: `null`.

</ParamField>

## Reopen alert

Action ID: `tools.google_secops_soar.reopen_alert`

Reopen a previously closed alert in a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="alert_identifier" type="string" required>

The alert identifier to reopen

</ParamField>

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_id" type="integer" required>

The case ID

</ParamField>

## Search SOAR cases

Action ID: `tools.google_secops_soar.search_cases`

Search Chronicle SOAR cases with advanced filtering.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="assigned_users" type="array[string] | null">

List of user IDs or @Role names

Default: `null`.

</ParamField>

<ParamField path="case_ids" type="array[integer] | null">

List of specific case IDs to retrieve

Default: `null`.

</ParamField>

<ParamField path="end_time" type="string | null">

UTC end time (ISO 8601 format). Only used when time_range_filter=0 (CUSTOM)

Default: `null`.

</ParamField>

<ParamField path="environments" type="array[string] | null">

List of environments to filter by

Default: `null`.

</ParamField>

<ParamField path="importance" type="array[string] | null">

Filter by importance: ['True'] for important cases only

Default: `null`.

</ParamField>

<ParamField path="incident" type="array[string] | null">

Filter by incident flag: ['True'] for incidents only

Default: `null`.

</ParamField>

<ParamField path="is_case_closed" type="boolean | null">

Filter by case status (true=closed, false=open, null=all)

Default: `null`.

</ParamField>

<ParamField path="page_size" type="integer">

Number of results per page (max 100)

Default: `50`.

</ParamField>

<ParamField path="priorities" type="array[string] | null">

List of priorities: Informative, Low, Medium, High, Critical

Default: `null`.

</ParamField>

<ParamField path="requested_page" type="integer">

Page number (0-indexed)

Default: `0`.

</ParamField>

<ParamField path="stages" type="array[string] | null">

List of stages: Triage, Assessment, Investigation, Incident, Improvement, Research

Default: `null`.

</ParamField>

<ParamField path="start_time" type="string | null">

UTC start time (ISO 8601 format, e.g., '2024-01-01T00:00:00.000Z'). Only used when time_range_filter=0 (CUSTOM)

Default: `null`.

</ParamField>

<ParamField path="tags" type="array[string] | null">

List of case tags to filter by

Default: `null`.

</ParamField>

<ParamField path="time_range_filter" type="integer | null">

Predefined time range in days: 0=CUSTOM, 1=LAST_DAY, 2=LAST_2_DAYS, 3=LAST_3_DAYS, 4=LAST_4_DAYS, 7=LAST_WEEK, 14=LAST_2_WEEKS, 30=LAST_MONTH, 90=LAST_3_MONTHS, 180=LAST_6_MONTHS, 365=LAST_YEAR, 395=LAST_13_MONTHS

Default: `null`.

</ParamField>

<ParamField path="title" type="string | null">

Search by case title/name (partial match supported)

Default: `null`.

</ParamField>

## Update alert priority

Action ID: `tools.google_secops_soar.update_alert_priority`

Update the priority of a specific alert within a case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="alert_identifier" type="string" required>

The alert identifier

</ParamField>

<ParamField path="alert_name" type="string" required>

The alert name

</ParamField>

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_id" type="integer" required>

The case ID

</ParamField>

<ParamField path="priority" type="integer" required>

New priority: -1=Informative, 40=Low, 60=Medium, 80=High, 100=Critical

</ParamField>

<ParamField path="previous_priority" type="integer">

Previous priority (0=Unchanged if unknown)

Default: `0`.

</ParamField>

## Update case comment

Action ID: `tools.google_secops_soar.update_case_comment`

Update an existing comment in a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="comment" type="string" required>

Updated comment text

</ParamField>

<ParamField path="comment_id" type="integer" required>

The comment ID to update

</ParamField>

<ParamField path="attachment_id" type="integer | null">

Optional attachment ID to update

Default: `null`.

</ParamField>

<ParamField path="base64_blob" type="string | null">

Optional updated base64-encoded file content

Default: `null`.

</ParamField>

<ParamField path="file_name" type="string | null">

Optional updated filename

Default: `null`.

</ParamField>

<ParamField path="file_type" type="string | null">

Optional updated file type

Default: `null`.

</ParamField>

## Update case priority

Action ID: `tools.google_secops_soar.update_case_priority`

Update the priority of a Chronicle SOAR case.

### Secrets

Required secrets:

- `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle SOAR API base URL (e.g., 'https://your-instance.siemplify-soar.com/api/external/v1')

</ParamField>

<ParamField path="case_id" type="integer" required>

The case ID

</ParamField>

<ParamField path="priority" type="integer" required>

Priority: -1=Informative, 40=Low, 60=Medium, 80=High, 100=Critical

</ParamField>
