feat: add case close root cause discovery tools (#124) - #314
Open
dandye wants to merge 1 commit into
Open
Conversation
- Add list_case_close_root_causes tool in secops-soar MCP server to discover configured case close root causes and map reasons (Malicious, NotMalicious, Maintenance, Inconclusive) via GetRootCauseCloseRecords. - Add list_case_close_definitions tool in secops MCP server to query Chronicle 1P caseCloseDefinitions with pagination and filtering support. - Add unit test suites for both tools with full coverage of default and filtered requests as well as error handling. - Update documentation in docs/servers/secops_soar_mcp.md and docs/servers/secops_mcp.md. Closes #124
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves #124 by adding tools to discover case close root causes and close reasons in both the legacy SOAR MCP server and the Chronicle 1P API MCP server.
Problem
Closing a case in Google SecOps requires specifying a valid
root_causeandreasonconfigured for the tenant. Prior to this PR, neither MCP server exposed a way to discover allowed root causes, leaving agents and analysts unable to determine valid values needed to close cases.Changes
1. Legacy SOAR (
server/secops-soar)Endpoints.GET_ROOT_CAUSE_CLOSE_RECORDS(/api/external/v1/settings/GetRootCauseCloseRecords) insecops_soar_mcp/utils/consts.py.list_case_close_root_causestool insecops_soar_mcp/case_management.py. Maps integer close reasons (0: Malicious,1: NotMalicious,2: Maintenance,3: Inconclusive) and returns tenant root causes.server/secops-soar/tests/unit/test_case_management.py.docs/servers/secops_soar_mcp.mdwith tool documentation and response example.2. Chronicle 1P API (
server/secops)list_case_close_definitionstool insecops_mcp/tools/case_close_definitions.py. QueriescaseCloseDefinitionswith pagination (page_size,page_token) and filter parameters (filter,order_by) usingchronicle_paginated_request.secops_mcp/tools/__init__.py.server/secops/tests/test_case_close_definitions_unit.py.docs/servers/secops_mcp.mdunder a new Case Management section.Verification
All unit tests pass across both server packages:
server/secops-soar: 7/7 unit tests passing (pytest server/secops-soar/tests/unit)server/secops: 28/28 unit tests passing (pytest server/secops/tests)Closes #124