Skip to content

fix(secops): validate alert_id and return structured dict for alert tools - #310

Open
dandye wants to merge 1 commit into
mainfrom
fix/issue-265-security-alert-by-id
Open

fix(secops): validate alert_id and return structured dict for alert tools#310
dandye wants to merge 1 commit into
mainfrom
fix/issue-265-security-alert-by-id

Conversation

@dandye

@dandye dandye commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator

Summary

Addresses #265:

  • Parameter Validation & Typing: Made alert_id: str a required first parameter on both get_security_alert_by_id and do_update_security_alert, and added validation to prevent passing None or empty strings to the Chronicle SDK.
  • Structured Dict Return: Changed return types from escaped JSON strings (json.dumps(...)) to structured dictionaries (Dict[str, Any]), matching the actual SDK output format and downstream client/test expectations.
  • Error Handling: Log exceptions with logger.error(..., exc_info=True) and return structured error dictionaries ({"error": ...}). Corrected copy-paste typo in do_update_security_alert exception message.
  • Documentation: Updated docstrings to accurately document parameters, return types, and descriptions.

Fixes #265


Verification

  • Hermetic Unit Tests: Added 8 unit test cases in tests/test_security_alerts_unit.py testing required parameter validation, structured dictionary return values, SDK call parameters, and error handling.
  • Test Suite: Verified all 33 unit tests pass cleanly:
    uv run pytest tests/test_security_alerts_unit.py tests/test_secops_tools_unit.py tests/test_secops_parser_management_unit.py -v
  • Linter & Formatting:
    uvx ruff check tests/test_security_alerts_unit.py
    uvx ruff format --check tests/test_security_alerts_unit.py

…ools

- Make alert_id a required parameter and validate against empty/None values
- Return structured alert dictionary directly instead of raw json.dumps string
- Update return type annotations and docstrings to Dict[str, Any]
- Return structured error dictionary and log errors with exc_info
- Fix copy-paste error in do_update_security_alert exception message
- Add unit test coverage for validation, dict return shape, and error handling

Fixes #265
@dandye
dandye requested a review from a team September 9, 2026 02:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

secops_mcp_get_security_alert_by_id_bug

1 participant