MCP Tools Reference: chronicle.googleapis.com

Create a new data table in Chronicle SIEM by calling the CreateDataTable API.

Creates a structured data table that can be referenced in detection rules. The agent is responsible for defining the table schema via the column_info argument.

Agent Responsibilities:1. Construct column_info :The agent MUST provide the complete column_info list. Each element in the list is an object (dictionary) defining a column, and must match the Chronicle API's DataTableColumnInfo structure. This includes: - columnIndex : Integer, starting from 0. - originalColumn : String, the name of the column. - columnType : String, one of "STRING", "REGEX", "CIDR", "NUMBER". This is mutually exclusive with mappedColumnPath . - mappedColumnPath : String, the UDM field path if mapping to an entity. Mutually exclusive with columnType . - key_column : Optional boolean. - repeated_values : Optional boolean. 2. Example for a single item in column_info : {"columnIndex": 0, "originalColumn": "ip", "columnType": "CIDR"} {"columnIndex": 1, "originalColumn": "user_agent", "mappedColumnPath": "network.http.user_agent"}

Workflow Integration:- Use to store structured security data that enhances detection rule logic. - Essential for maintaining context data used in threat detection and investigation. - Enables dynamic rule behavior based on curated datasets without hardcoding values. - Supports threat intelligence integration by storing IOC lists and contextual data.

Use Cases:- Create tables of known malicious IP addresses with severity and description context. - Store asset inventories with criticality ratings for enhanced alert prioritization. - Maintain user role mappings for behavior-based detection rules. - Build threat intelligence feeds with IOC metadata for detection enhancement. - Create exception lists for reducing false positives in detection rules.

Column Types:- STRING: Text values - CIDR: IP address ranges (e.g., "192.168.1.0/24") - INT64: Integer values - BOOL: Boolean values (true/false)

Args: name (str): Unique name for the data table. description (str): Description of the data table. column_info (List[Dict[str, Any]]): A list of dictionaries, where each dictionary defines a column, adhering to the DataTableColumnInfo structure. project_id (str): Google Cloud project ID (required). customer_id (str): Chronicle customer ID (required). region (str): Chronicle region (e.g., "us", "europe") (required).

Returns: str: Success message with the created data table details from the API response. Returns error message if table creation fails.

Example Usage: # Create a table for suspicious IP addresses create_data_table( name="suspicious_ips", description="Known suspicious IP addresses with context", column_info=[ {"columnIndex": 0, "originalColumn": "ip_address", "columnType": "CIDR"}, {"columnIndex": 1, "originalColumn": "severity", "columnType": "STRING"}, {"columnIndex": 2, "originalColumn": "description", "columnType": "STRING"}, {"columnIndex": 3, "originalColumn": "is_active", "columnType": "STRING"} # Note: BOOL is not a type, use STRING for true/false ], project_id="my-project", customer_id="my-customer", region="us" )

Next Steps (using MCP-enabled tools): - Add rows using add_rows_to_data_table . - Reference the table in detection rules using the table name (e.g., data_table.suspicious_ips). - List table contents using list_data_table_rows to verify data integrity. - Update or remove specific rows using data table row management tools. - Use the table data to enhance detection logic and reduce false positives.

The following sample demonstrate how to use curl to invoke the create_data_table MCP tool.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌