> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Security Operations

> Give the Sazabi agent tools to search Google SecOps cases, alerts, entities, UDM events, rules, and detections while investigating a security signal.

[All Google Security Operations integration capabilities](https://docs.sazabi.com/catalogs/integrations/google-secops)

## About

This is an MCP connector that gives the Sazabi agent tools from Google Security Operations' first-party remote MCP server, hosted per region at `https://<region>-chronicle.googleapis.com/mcp`. Google's remote MCP servers do not support automatic client registration, so you supply a Google OAuth 2.0 access token. Sazabi stores the token securely and sends it in the `Authorization` header. Access is scoped by Google IAM.

**What the agent can do:**

* List and read cases, case alerts, and security alerts
* Search entities, UDM events, and raw logs, and translate a question into a UDM query
* Inspect rules, rule detections, rule errors, and IOC matches
* Read automated investigation results, playbooks, integrations, and log parsers

**What stays read-only:** Sazabi exposes only the functions Google marks read-only. Functions that edit cases, alerts, rules, parsers, feeds, or data tables, import logs, trigger investigations, or run response actions are blocked, so the agent never changes your SecOps instance. Google's single access scope allows both reading and changing data, so also give the identity the read-only Chronicle API Viewer role.

## Prerequisites

* A Google SecOps instance bound to a Google Cloud project with the Google Security Operations API enabled
* Your Google SecOps region (for example `us` or `europe`); you select it when connecting
* A Google OAuth 2.0 access token for an identity with these IAM roles on that project: Chronicle API Viewer (`roles/chronicle.viewer`), MCP Tool User (`roles/mcp.toolUser`), and Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`)

## Set up in the dashboard

Configure connectors in the dashboard under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 1**

### Open the connector

Find Google Security Operations in [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 2**

### Choose your region

Select the region your Google SecOps instance runs in. Sazabi connects to `https://<region>-chronicle.googleapis.com/mcp`.

**Step 3**

### Create and paste an access token

Install the [gcloud CLI](https://cloud.google.com/sdk/docs/install), then run `gcloud auth application-default login --scopes=https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/chronicle` and `gcloud auth application-default print-access-token`. Paste the raw token into Sazabi. Sazabi adds the `Bearer` prefix and sends it in the `Authorization` header.

Google access tokens expire after about an hour. When the token expires, create a new one and update the connector.

## Set up with the CLI

Google Security Operations authenticates with a Google OAuth 2.0 access token. With the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) installed and authenticated (see [`sazabi mcp-connectors` reference](https://docs.sazabi.com/reference/cli/mcp-connectors)), connect it in one command, passing the credential as a header:

```bash theme={"system"}
sazabi mcp-connectors connect google-secops \
  --server-url https://<region>-chronicle.googleapis.com/mcp \
  --header "Authorization=Bearer <access-token>"
```

Replace `<region>` with your Google SecOps region, such as `us` or `europe`. Without `--server-url`, the CLI connects to the `us` endpoint.

The CLI connects to the MCP server at once and prints the connection with the tools it discovered; a credential the server rejects is reported, and the connection is left needing attention. Use `NAME=@<file>` to read a value from a file, or `--header-file <file.json>` for a JSON object of header names and values. To rotate the stored credentials later, use `sazabi mcp-connectors update-credentials <connection-id>`; find the connection ID with `sazabi mcp-connectors list`.

## Verify

Open the connector's connection page under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors) and confirm Sazabi lists the tools it discovered. Then, in a thread, give the agent your Google Cloud project ID, Google SecOps customer ID, and region, and ask it to list recent cases. If no tools appear, confirm the access token is current.

## Troubleshooting

**No tools discovered or the connection shows needs attention** — The access token has likely expired. Create a new token and update the connector from [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Calls fail with a permission error** — Confirm the identity has Chronicle API Viewer, MCP Tool User, and Service Usage Consumer on the project bound to your Google SecOps instance, and that the Google Security Operations API is enabled there.

**Calls fail with a not-found error** — Check that the region you selected matches your instance and that the customer ID and project ID you gave the agent are correct.

## Further reading

> [card] [Agent tools](https://docs.sazabi.com/guides/investigate/agent-tools.md)
>
> How the agent uses connector tools.

> [card] [MCP connectors](https://docs.sazabi.com/catalogs/mcp-connectors.md)
>
> Browse the connector catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.