Skip to main content
All Google Security Operations integration capabilities

​
About

This is an MCP connector that gives the Sazabi agent tools from Google Security Operations’ first-party remote MCP server, hosted per region at https://<region>-chronicle.googleapis.com/mcp. Google’s remote MCP servers do not support automatic client registration, so you supply a Google OAuth 2.0 access token. Sazabi stores the token securely and sends it in the Authorization header. Access is scoped by Google IAM. What the agent can do:
  • List and read cases, case alerts, and security alerts
  • Search entities, UDM events, and raw logs, and translate a question into a UDM query
  • Inspect rules, rule detections, rule errors, and IOC matches
  • Read automated investigation results, playbooks, integrations, and log parsers
What stays read-only: Sazabi exposes only the functions Google marks read-only. Functions that edit cases, alerts, rules, parsers, feeds, or data tables, import logs, trigger investigations, or run response actions are blocked, so the agent never changes your SecOps instance. Google’s single access scope allows both reading and changing data, so also give the identity the read-only Chronicle API Viewer role.

​
Prerequisites

  • A Google SecOps instance bound to a Google Cloud project with the Google Security Operations API enabled
  • Your Google SecOps region (for example us or europe); you select it when connecting
  • A Google OAuth 2.0 access token for an identity with these IAM roles on that project: Chronicle API Viewer (roles/chronicle.viewer), MCP Tool User (roles/mcp.toolUser), and Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)

​
Set up in the dashboard

Configure connectors in the dashboard under Settings > MCP connectors.
1

​
Open the connector

Find Google Security Operations in Settings > MCP connectors.
2

​
Choose your region

Select the region your Google SecOps instance runs in. Sazabi connects to https://<region>-chronicle.googleapis.com/mcp.
3

​
Create and paste an access token

Install the gcloud CLI, then run gcloud auth application-default login --scopes=https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/chronicle and gcloud auth application-default print-access-token. Paste the raw token into Sazabi. Sazabi adds the Bearer prefix and sends it in the Authorization header.Google access tokens expire after about an hour. When the token expires, create a new one and update the connector.

​
Set up with the CLI

Google Security Operations authenticates with a Google OAuth 2.0 access token. With the Sazabi CLI installed and authenticated (see sazabi mcp-connectors reference), connect it in one command, passing the credential as a header:
Replace <region> with your Google SecOps region, such as us or europe. Without --server-url, the CLI connects to the us endpoint. The CLI connects to the MCP server at once and prints the connection with the tools it discovered; a credential the server rejects is reported, and the connection is left needing attention. Use NAME=@<file> to read a value from a file, or --header-file <file.json> for a JSON object of header names and values. To rotate the stored credentials later, use sazabi mcp-connectors update-credentials <connection-id>; find the connection ID with sazabi mcp-connectors list.

​
Verify

Open the connector’s connection page under Settings > MCP connectors and confirm Sazabi lists the tools it discovered. Then, in a thread, give the agent your Google Cloud project ID, Google SecOps customer ID, and region, and ask it to list recent cases. If no tools appear, confirm the access token is current.

​
Troubleshooting

No tools discovered or the connection shows needs attention — The access token has likely expired. Create a new token and update the connector from Settings > MCP connectors. Calls fail with a permission error — Confirm the identity has Chronicle API Viewer, MCP Tool User, and Service Usage Consumer on the project bound to your Google SecOps instance, and that the Google Security Operations API is enabled there. Calls fail with a not-found error — Check that the region you selected matches your instance and that the customer ID and project ID you gave the agent are correct.

​
Further reading

Agent tools

How the agent uses connector tools.

MCP connectors

Browse the connector catalog.