---
title: "Google SecOps Detection Engine"
description: "Reference for the Tracecat Google SecOps Detection Engine integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Cancel retrohunt

Action ID: `tools.google_secops_detection.cancel_retrohunt`

Cancel a running retrohunt operation.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="retrohunt_id" type="string" required>

The retrohunt ID to cancel

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID

</ParamField>

## Create detection rule

Action ID: `tools.google_secops_detection.create_rule`

Create a new detection rule in Chronicle.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_text" type="string" required>

YARA-L 2.0 rule text

</ParamField>

## Create retrohunt

Action ID: `tools.google_secops_detection.create_retrohunt`

Create a retrohunt to run a rule against historical data.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="end_time" type="string" required>

End time (RFC 3339 format)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID to run retrohunt for

</ParamField>

<ParamField path="start_time" type="string" required>

Start time (RFC 3339 format, e.g., '2024-01-01T00:00:00Z')

</ParamField>

## Delete detection rule

Action ID: `tools.google_secops_detection.delete_rule`

Delete a detection rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID to delete

</ParamField>

## Disable detection rule

Action ID: `tools.google_secops_detection.disable_rule`

Disable a detection rule to stop live alerting.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID to disable

</ParamField>

## Enable detection rule

Action ID: `tools.google_secops_detection.enable_rule`

Enable a detection rule for live alerting.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID to enable

</ParamField>

## Get detection rule

Action ID: `tools.google_secops_detection.get_rule`

Get detailed information about a specific detection rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID (e.g., 'ru_12345678-1234-1234-1234-123456789012')

</ParamField>

## Get retrohunt status

Action ID: `tools.google_secops_detection.get_retrohunt`

Get the status and results of a retrohunt operation.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="retrohunt_id" type="string" required>

The retrohunt ID

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID

</ParamField>

## Get rule deployment status

Action ID: `tools.google_secops_detection.get_rule_deployment`

Get the deployment status of a detection rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID

</ParamField>

## List detection rules

Action ID: `tools.google_secops_detection.list_rules`

List all detection rules in Chronicle.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="page_size" type="integer">

Maximum number of rules to return

Default: `100`.

</ParamField>

<ParamField path="page_token" type="string | null">

Token for pagination

Default: `null`.

</ParamField>

## List detections for rule

Action ID: `tools.google_secops_detection.list_detections`

List detections generated by a specific rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID to get detections for

</ParamField>

<ParamField path="end_time" type="string | null">

End time (RFC 3339 format)

Default: `null`.

</ParamField>

<ParamField path="page_size" type="integer">

Maximum detections to return

Default: `100`.

</ParamField>

<ParamField path="page_token" type="string | null">

Token for pagination

Default: `null`.

</ParamField>

<ParamField path="start_time" type="string | null">

Start time (RFC 3339 format, e.g., '2024-01-01T00:00:00Z')

Default: `null`.

</ParamField>

## List retrohunts

Action ID: `tools.google_secops_detection.list_retrohunts`

List all retrohunt operations for a specific rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID

</ParamField>

<ParamField path="page_size" type="integer">

Maximum retrohunts to return

Default: `100`.

</ParamField>

<ParamField path="page_token" type="string | null">

Token for pagination

Default: `null`.

</ParamField>

## List rule errors

Action ID: `tools.google_secops_detection.list_rule_errors`

List compilation or execution errors for a detection rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID

</ParamField>

<ParamField path="page_size" type="integer">

Maximum errors to return

Default: `100`.

</ParamField>

<ParamField path="page_token" type="string | null">

Token for pagination

Default: `null`.

</ParamField>

## Update detection rule

Action ID: `tools.google_secops_detection.update_rule`

Update an existing detection rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_id" type="string" required>

The rule ID to update

</ParamField>

<ParamField path="rule_text" type="string" required>

Updated YARA-L 2.0 rule text

</ParamField>

## Verify detection rule

Action ID: `tools.google_secops_detection.verify_rule`

Verify YARA-L rule syntax without creating the rule.

### Secrets

Required secrets:

- `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string" required>

Chronicle API base URL (e.g., 'https://backstory.googleapis.com' for US, 'https://europe-backstory.googleapis.com' for EU, 'https://asia-southeast1-backstory.googleapis.com' for Asia)

</ParamField>

<ParamField path="rule_text" type="string" required>

YARA-L 2.0 rule text to validate

</ParamField>
