Connect Google SecOps to Claude: Orchestrate Threat Detection & Rules

If your team needs to connect Google SecOps (formerly Chronicle) to Claude to automate threat hunting, triage security incidents, or orchestrate SIEM/SOAR workflows, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's JSON-RPC tool calls and the Google SecOps REST APIs. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses ChatGPT, check out our sibling guide on /connect-google-secops-to-chatgpt-manage-security-incidents-cases/ or explore our broader architectural overview on /connect-google-secops-to-ai-agents-automate-ingestion-soar-tasks/.

Giving a Large Language Model (LLM) read and write access to a sprawling security operations ecosystem like Google SecOps is a serious engineering challenge. You have to handle complex API token lifecycles, map massive Unified Data Model (UDM) schemas to MCP tool definitions, and manage long-running asynchronous search operations. Every time Google SecOps introduces a new SOAR entity or modifies a case schema, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Google SecOps, connect it natively to Claude, and execute complex security operations using natural language.

The Engineering Reality of the Google SecOps API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against specialized enterprise security APIs is painful. Google SecOps is built to ingest petabytes of telemetry, resolve complex entity graphs, and execute automated playbooks. Its API reflects that immense scale and complexity.

If you decide to build a custom Google SecOps MCP server, here are the specific integration challenges you will face:

Asynchronous UDM Searches and Polling Google SecOps relies heavily on its Unified Data Model (UDM) for threat hunting. Querying this data via the API is not a simple synchronous GET request. Endpoints like google_sec_ops_instances_search initiate a long-running search operation and immediately return an operation ID. An LLM has no inherent concept of asynchronous polling loops. To make this work via MCP, you must either build middleware that abstracts the polling state away from the LLM, or provide explicit polling tools (get_single_google_sec_ops_operation_by_id) and prompt the model to wait for a COMPLETED status.

Complex Relational Entity Graphs In Google SecOps, a security incident is never just a flat JSON object. A Case contains CaseAlerts, which in turn contain InvolvedEntities (actors, IP addresses, assets), which can have custom ContextProperties. When an LLM asks "What is happening in Case 123?", a naive MCP server would just return the top-level case metadata. A properly designed integration layer must map these nested relationships into modular, callable tools so the LLM can traverse the entity graph organically.

Strict Rate Limits and Error Handling Google SecOps strictly enforces API quotas to prevent tenant exhaustion. Truto handles this transparently but deliberately: Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Google SecOps API returns an HTTP 429, Truto passes that exact error back to the caller. However, Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (or the orchestrating agent framework) is fully responsible for implementing its own retry and backoff logic using these standard headers.

Generating a Google SecOps MCP Server via Truto

Truto dynamically derives MCP tool definitions from the Google SecOps integration's underlying resources and documentation schemas. A tool only appears in the MCP server if it has a corresponding documentation entry, ensuring only well-described, high-quality endpoints are exposed to the LLM.

Each MCP server is scoped to a single integrated account (a connected Google SecOps instance for a specific tenant) and authenticated via a cryptographic token URL.

Method 1: Creating the MCP Server via the Truto UI

For teams moving quickly, you can generate an MCP server directly from the Truto dashboard:

1. Navigate to the Integrated Accounts page and select your connected Google SecOps instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration. You can filter by HTTP methods (e.g., only read operations) or specific tags (e.g., cases, alerts).
5. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Creating the MCP Server via the Truto API

For teams embedding AI capabilities programmatically, you can generate MCP servers via the Truto REST API. The API validates that the integration has tools available, generates a secure token, and returns a ready-to-use URL.

Endpoint: POST /integrated-account/:id/mcp

Request Body:

{
  "name": "Google SecOps SOC Agent",
  "config": {
    "methods": ["read", "write"],
    "tags": ["cases", "alerts", "hunting"]
  },
  "expires_at": "2026-12-31T23:59:59Z"
}

Response:

{
  "id": "9876-abcd-efgh-1234",
  "name": "Google SecOps SOC Agent",
  "config": {
    "methods": ["read", "write"],
    "tags": ["cases", "alerts", "hunting"]
  },
  "expires_at": "2026-12-31T23:59:59Z",
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

This URL alone is enough to authenticate and serve tools to your MCP client.

Connecting the MCP Server to Claude

Once you have your Truto MCP URL, you can connect it to Claude in under a minute.

Method 1: Via the Claude Desktop UI (Custom Connectors)

If you are using Claude Desktop on a paid plan (Pro, Team, or Enterprise), you can add remote MCP servers directly through the user interface:

1. Open Claude Desktop.
2. Navigate to Settings - Integrations - Add MCP Server (or Settings - Connectors - Add custom connector depending on your exact version).
3. Paste your Truto MCP URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).
4. Click Add.

Claude will immediately perform a JSON-RPC handshake with Truto, fetch the Google SecOps tool definitions, and make them available in your chat interface.

Method 2: Via the claude_desktop_config.json File

For developers or those automating deployments, you can manually configure Claude Desktop to route MCP requests to Truto using the official SSE (Server-Sent Events) transport wrapper.

Open your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the Truto MCP server using the @modelcontextprotocol/server-sse package (requires Node.js):

{
  "mcpServers": {
    "google_secops": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Restart Claude Desktop. The agent will now have real-time access to Google SecOps.

Hero Tools for Google SecOps Automation

Truto exposes the entirety of the Google SecOps API as discrete MCP tools. Here are six high-leverage "hero" tools that empower Claude to act as a fully autonomous Level 1 SOC analyst.

1. Execute UDM Threat Searches

Tool: google_sec_ops_instances_search

This tool initiates a long-running Unified Data Model (UDM) search across your telemetry. Because UDM queries process massive datasets, this tool returns an operation ID rather than immediate results. You must instruct Claude to poll the operation status.

"Run a UDM search over the last 24 hours for any process execution events where the target process is 'powershell.exe' and the command line includes 'hidden'. Return the operation ID and wait for it to complete."

2. Monitor Case Queues

Tool: list_all_google_sec_ops_cases

Retrieves a paginated list of ongoing security cases. This is the starting point for triage workflows, allowing Claude to filter cases by priority, stage, or assigned analyst.

"List all open Google SecOps cases with a 'Critical' priority that are currently unassigned in the default environment."

3. Investigate Specific Case Details

Tool: get_single_google_sec_ops_case_by_id

Fetches the complete metadata for a specific case. This provides the LLM with the context it needs to understand the scope of the incident before taking action.

"Get the full details for case ID 'case-8493-beta'. Summarize the stage of the investigation and list the primary tags applied to the case."

4. Analyze Attached Case Alerts

Tool: list_all_google_sec_ops_case_alerts

Cases are containers for alerts. This tool allows Claude to retrieve every individual alert associated with a specific case, enabling deep-dive analysis into the underlying indicators of compromise (IOCs).

"Fetch all alerts associated with case ID 'case-8493-beta'. Group the alerts by their severity and identify any recurring external IP addresses."

5. Document Findings

Tool: create_a_google_sec_ops_case_comment

Allows the AI agent to log its investigative notes, summaries, or recommendations directly to the case wall. This ensures human analysts can review the AI's logic and findings.

"Add a comment to case ID 'case-8493-beta' stating: 'Automated triage complete. 4 alerts identified originating from known Tor exit nodes. Escalation to Level 2 recommended.'"

6. Automate False Positive Remediation

Tool: google_sec_ops_cases_execute_bulk_close

Automates the closure of multiple cases simultaneously. This is incredibly powerful for clearing queues of known false positives or low-priority noisy alerts. A valid closure reason and root cause must be provided.

"Bulk close the following case IDs: 'case-111', 'case-112', and 'case-113'. Use the closure reason 'False Positive' and add a comment indicating they match the known safe vulnerability scanner IP range."

To view the complete inventory of available Google SecOps tools, schemas, and required parameters, visit the Google SecOps Integration Page.

Workflows in Action

Once Claude is equipped with the Google SecOps MCP server, you can orchestrate multi-step security workflows using natural language. Here is how specific SOC personas leverage these capabilities.

Scenario 1: Triage and Bulk Close False Positives

A Level 1 SOC Analyst often spends hours closing repetitive, noisy alerts. By combining Claude with the Google SecOps MCP server, this process can be fully automated based on predefined heuristic checks.

"List all open cases tagged with 'Failed Login'. For each case, check the associated alerts. If all alerts originate from the IP address 192.168.1.50 (our known vulnerability scanner), bulk close those cases with the reason 'False Positive'."

Step-by-step execution:

1. Claude calls list_all_google_sec_ops_cases with a filter for the 'Failed Login' tag and an 'open' status.
2. For each returned case ID, Claude calls list_all_google_sec_ops_case_alerts.
3. Claude parses the alert data to isolate the originating IP addresses.
4. Identifying that several cases exclusively involve the safe IP 192.168.1.50, Claude compiles a list of those case IDs.
5. Claude calls google_sec_ops_cases_execute_bulk_close passing the compiled IDs, setting the reason to 'False Positive'.

sequenceDiagram
    participant Analyst as SOC Analyst
    participant Claude as Claude Desktop
    participant Truto as Truto MCP
    participant SecOps as Google SecOps

    Analyst->>Claude: "Clear scanner false positives..."
    Claude->>Truto: call tools/list_all_google_sec_ops_cases
    Truto->>SecOps: GET /v1/.../cases?filter=tags="Failed Login"
    SecOps-->>Truto: Return cases
    Truto-->>Claude: JSON case array
    Claude->>Truto: call tools/list_all_google_sec_ops_case_alerts (per case)
    Truto->>SecOps: GET /v1/.../caseAlerts
    SecOps-->>Truto: Return alerts
    Truto-->>Claude: JSON alert array
    Note over Claude: Evaluates IP addresses against<br>known safe scanner list
    Claude->>Truto: call tools/google_sec_ops_cases_execute_bulk_close
    Truto->>SecOps: POST /v1/.../cases:executeBulkClose
    SecOps-->>Truto: Success
    Truto-->>Claude: Operation confirmed
    Claude-->>Analyst: "Closed 14 false positive cases."

Scenario 2: Automated Threat Hunting and Enrichment

Threat hunters need to rapidly pivot from an indicator of compromise (IOC) to all affected entities in the environment. Claude can orchestrate complex UDM searches and attach the findings directly to an investigation.

"Initiate a UDM search for any network connections to the domain 'evil-c2-server.com' over the last 48 hours. Wait for the search to complete. If any internal hostnames are found, add a comment to case ID 'case-999' listing those compromised hosts."

Step-by-step execution:

1. Claude calls google_sec_ops_instances_search with the UDM query target.hostname = "evil-c2-server.com" and a 48-hour time range.
2. Google SecOps returns an operation ID. Claude recognizes this is a long-running task.
3. Claude repeatedly calls get_single_google_sec_ops_operation_by_id until the status returns COMPLETED.
4. Claude calls list_all_google_sec_ops_search_session_searched_results using the completed search session ID to retrieve the matching events.
5. Claude extracts the internal hostnames from the event JSON.
6. Claude calls create_a_google_sec_ops_case_comment on case-999, writing a clear markdown summary of the compromised hosts found in the telemetry.

Security and Access Control

Exposing a platform as powerful as Google SecOps to an AI agent requires strict guardrails. Truto's MCP architecture provides several layers of security to ensure Claude only operates within designated boundaries:

• Method Filtering: When generating the MCP token, you can restrict the server to only read operations (e.g., get, list). This allows Claude to investigate cases and run searches, but explicitly prevents it from altering data, changing SLAs, or closing cases.
• Tag Filtering: You can scope the MCP server to specific functional areas using tags. For example, passing "tags": ["hunting"] ensures the LLM can only see and execute tools related to UDM searches and IOCs, hiding unrelated administrative endpoints.
• API Token Authentication: By default, possessing the MCP URL grants access to the tools. For higher-security SOC environments, setting require_api_token_auth: true forces the MCP client to also pass a valid Truto API token in the Authorization header. This ensures only authenticated security personnel can leverage the AI agent.
• Time-Bound Access: Using the expires_at parameter allows you to generate short-lived MCP servers. This is ideal for automated incident response workflows where a temporary agent is spun up to handle a specific breach and its access is automatically revoked after 24 hours.

Streamline Security Operations with Managed MCP

Connecting Google SecOps to Claude transforms how security teams handle data ingestion, threat hunting, and incident triage. By utilizing Truto's managed MCP servers, you bypass the massive engineering overhead of building custom API middleware, handling pagination, and managing OAuth lifecycles. Truto dynamically maps Google SecOps's complex REST architecture into modular, AI-ready tools in real-time.

Stop writing custom integration scripts for every new playbook. Standardize your AI-to-SaaS connectivity with Truto.