Skip to main content

​
Add case tag

Action ID: tools.google_secops_soar.add_case_tag Add a tag to a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
integer
required
The case ID
​
string
required
Tag to add to the case
​
string | null
Optional alert identifier within the caseDefault: null.

​
Assign user to case

Action ID: tools.google_secops_soar.assign_user_to_case Assign a user or SOC role to a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
integer
required
The case ID
​
string
required
User ID (GUID) or @RoleName to assign
​
string | null
Optional alert identifier within the caseDefault: null.

​
Bulk close cases

Action ID: tools.google_secops_soar.bulk_close_cases Close multiple Chronicle SOAR cases in a single operation.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
array[integer]
required
List of case IDs to close
​
string
required
Comment for all closed cases
​
integer
required
Close reason enum: 0=Malicious, 1=NotMalicious, 2=Maintenance, 3=Inconclusive, 4=Unknown
​
string
required
Root cause description

​
Change case stage

Action ID: tools.google_secops_soar.change_case_stage Change the stage of a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
integer
required
The case ID
​
string
required
New stage: Triage, Assessment, Investigation, Incident, Improvement, or Research

​
Close alert

Action ID: tools.google_secops_soar.close_alert Close a specific alert within a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
The alert identifier to close
​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
string
required
Comment explaining why the alert is being closed
​
string
required
Close reason: Malicious, NotMalicious, Maintenance, or Inconclusive
​
string
required
Root cause description
​
integer
required
The case ID where the alert is being closed
​
string
Alert usefulness: None, NotUseful, or UsefulDefault: "None".

​
Create case comment

Action ID: tools.google_secops_soar.create_case_comment Add a comment to a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
integer
required
The case ID
​
string
required
Comment text to add to the case
​
string | null
Optional alert identifierDefault: null.
​
string | null
Optional base64-encoded file contentDefault: null.
​
string | null
Optional attachment filenameDefault: null.
​
string | null
Optional file type (e.g., ‘.pdf’, ‘.txt’)Default: null.

​
Reopen alert

Action ID: tools.google_secops_soar.reopen_alert Reopen a previously closed alert in a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
The alert identifier to reopen
​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
integer
required
The case ID

​
Search SOAR cases

Action ID: tools.google_secops_soar.search_cases Search Chronicle SOAR cases with advanced filtering.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
array[string] | null
List of user IDs or @Role namesDefault: null.
​
array[integer] | null
List of specific case IDs to retrieveDefault: null.
​
string | null
UTC end time (ISO 8601 format). Only used when time_range_filter=0 (CUSTOM)Default: null.
​
array[string] | null
List of environments to filter byDefault: null.
​
array[string] | null
Filter by importance: [‘True’] for important cases onlyDefault: null.
​
array[string] | null
Filter by incident flag: [‘True’] for incidents onlyDefault: null.
​
boolean | null
Filter by case status (true=closed, false=open, null=all)Default: null.
​
integer
Number of results per page (max 100)Default: 50.
​
array[string] | null
List of priorities: Informative, Low, Medium, High, CriticalDefault: null.
​
integer
Page number (0-indexed)Default: 0.
​
array[string] | null
List of stages: Triage, Assessment, Investigation, Incident, Improvement, ResearchDefault: null.
​
string | null
UTC start time (ISO 8601 format, e.g., ‘2024-01-01T00:00:00.000Z’). Only used when time_range_filter=0 (CUSTOM)Default: null.
​
array[string] | null
List of case tags to filter byDefault: null.
​
integer | null
Predefined time range in days: 0=CUSTOM, 1=LAST_DAY, 2=LAST_2_DAYS, 3=LAST_3_DAYS, 4=LAST_4_DAYS, 7=LAST_WEEK, 14=LAST_2_WEEKS, 30=LAST_MONTH, 90=LAST_3_MONTHS, 180=LAST_6_MONTHS, 365=LAST_YEAR, 395=LAST_13_MONTHSDefault: null.
​
string | null
Search by case title/name (partial match supported)Default: null.

​
Update alert priority

Action ID: tools.google_secops_soar.update_alert_priority Update the priority of a specific alert within a case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
The alert identifier
​
string
required
The alert name
​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
integer
required
The case ID
​
integer
required
New priority: -1=Informative, 40=Low, 60=Medium, 80=High, 100=Critical
​
integer
Previous priority (0=Unchanged if unknown)Default: 0.

​
Update case comment

Action ID: tools.google_secops_soar.update_case_comment Update an existing comment in a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
string
required
Updated comment text
​
integer
required
The comment ID to update
​
integer | null
Optional attachment ID to updateDefault: null.
​
string | null
Optional updated base64-encoded file contentDefault: null.
​
string | null
Optional updated filenameDefault: null.
​
string | null
Optional updated file typeDefault: null.

​
Update case priority

Action ID: tools.google_secops_soar.update_case_priority Update the priority of a Chronicle SOAR case.

​
Secrets

Required secrets:
  • google_secops_soar: required values GOOGLE_SECOPS_API_KEY.

​
Input fields

​
string
required
Chronicle SOAR API base URL (e.g., ‘https://your-instance.siemplify-soar.com/api/external/v1’)
​
integer
required
The case ID
​
integer
required
Priority: -1=Informative, 40=Low, 60=Medium, 80=High, 100=Critical