Can AI agents automate Google Security Operations?

Google · saas · enterpriseobservability

Google Security Operations is automatable today through Chronicle REST APIs and a Google-hosted remote MCP server. This record is SecOps SIEM and SOAR (formerly Chronicle), not Cloud Logging, Cloud Monitoring, Microsoft Sentinel, IBM QRadar, or CrowdStrike Falcon. The Chronicle API publishes REST resources under v1beta for instances, cases, alerts, events, feeds, rules, integrations, and related SOAR objects. The hosted MCP server is enabled with gcloud beta services mcp enable chronicle.googleapis.com/mcp and reached at https://chronicle.REGION.rep.googleapis.com/mcp. Callers authenticate with Application Default Credentials and a Bearer access token, need roles/mcp.toolUser, and must send customer id, region, and project id on requests. SIEM tools are available without migration. SOAR tools require Chronicle API migration away from legacy SOAR APIs. The google/mcp-security repository also ships local SecOps, SOAR, Threat Intelligence, and Security Command Center servers; Google recommends the remote server. Connector catalogs were not opened. Computer-use viability is unassessed. API scores 8 and is the best path because Chronicle REST does not depend on MCP enablement. MCP scores 7: official hosted coverage with IAM and SOAR-migration gates.

Best path today: api · Overall automatability: 8/10

Modalities

ModalityStatusDetail
APIyesrestoauth2
coverage: partial · docs
SDKunknown
official: unknown
MCPyes
verdict: official
Integrationsunknown
CLIunknown
Extensibilityyesyara-lsoar-playbooks
webhooks: unknown
Data access
export: json · import: unknown
RPA / UI automationunknownweb-dom
No repeatable UI probe was run. Chronicle REST, the hosted SecOps MCP endpoint, and playbook automation cover SIEM and SOAR work without browser control of the SecOps console. This record is not Google Cloud as a whole-cloud identity.
Computer useunknown
measured verdicts only — "unknown" means not yet probed by us

Scores

apimcpintegrationsclirpacomputer useoverall
87————8

Evidence

FactTierSourceDate
homepagedeclaredsource2026-09-15
licensedeclaredsource2026-09-15
platformsdeclaredsource2026-09-15
modalities.api.existsdeclaredsource2026-09-15
modalities.api.kinds[0]declaredsource2026-09-15
modalities.api.auth[0]declaredsource2026-09-15
modalities.api.coveragedeclaredsource2026-09-15
modalities.api.docsdeclaredsource2026-09-15
modalities.mcp.first_partydeclaredsource2026-09-15
modalities.mcp.verdictdeclaredsource2026-09-15
modalities.extensibility.scripting[0]declaredsource2026-09-15
modalities.extensibility.scripting[1]declaredsource2026-09-15
modalities.data_access.export[0]declaredsource2026-09-15
verdict.scores.apideclaredsource2026-09-15
verdict.scores.mcpdeclaredsource2026-09-15
freshness.watch[0].urldeclaredsource2026-09-15
freshness.watch[1].urldeclaredsource2026-09-15
freshness.watch[2].urldeclaredsource2026-09-15
freshness.watch[3].urldeclaredsource2026-09-15

Related tools

Other products in this database that share a category with Google Security Operations.

Last verified 2026-09-15 · volatility high · JSON record