Console
    Start free

    MCP Tools Reference: chronicle.googleapis.com

    Tool: update_case

    Updates an existing case in Google SecOps.

    Modifies various properties of a specific case. Only the fields provided in the arguments will be updated. Note: It is not possible to change the status of a case to 'CLOSED' using this tool. This can only be done via the 'execute_bulk_close_case' tool.

    Workflow Integration:- A core function for managing the lifecycle of a security case, used in both manual and automated workflows. - Integrates with UI actions like assigning a case, changing its status, or adding a description. - Essential for automated playbooks that need to update a case's status after performing an action, such as "Case moved to 'Remediation' after host was isolated." - Can be used to synchronize case status with external ticketing or project management systems.

    Use Cases:- An analyst assigns a case to themselves or another team member. - A SOC manager escalates a case by changing its priority from "Medium" to "Critical". - A user adds a detailed description or updates the title of a case to better reflect the investigation's findings. - Add or modify tags and products associated with the case.

    Args: project_id (str): Google Cloud project ID (required). customer_id (str): Chronicle customer ID (required). region (str): Chronicle region (e.g., "us", "europe") (required). case_id (str): The numeric ID of the Case to update (e.g., '12345'). This is a required field. display_name (str, optional): The new display name for the case. stage (str, optional): The new stage of the case. The Stage options are: ['Research', 'Improvement', 'Incident', 'Investigation', 'Assessment', 'Triage']. priority (backstory.Priority, optional): The new priority of the case (e.g., "PRIORITY_HIGH", "PRIORITY_CRITICAL"). important (bool, optional): Whether the case is marked as important. incident (bool, optional): Whether the case is marked as an incident. assignee (str, optional): The user or role to assign to the case. description (str, optional): The new description for the case. environment (str, optional): The environment associated with the case. move_environment (google.cloud.chronicle.v1alpha.Case.MoveEnvironment, optional): Details about moving the case to a different environment.

    Returns: Case: The updated Case object with the new values. The Case object contains the following key fields: - Name (str): The full resource name of the case. - Id (int): The unique identifier for the case. - DisplayName (str): The title or display name of the case. - Stage (str): The current stage of the case (e.g., "Triage", "Investigation"). - Priority (str): The priority of the case (e.g., "PRIORITY_HIGH"). - Assignee (str): The user or group assigned to the case. - Description (str): A detailed description of the case. - Status (str): The current status of the case (e.g., "OPENED", "CLOSED"). - CreateTime (int): The creation timestamp of the case in milliseconds. - UpdateTime (int): The last update timestamp of the case in milliseconds. - Tags (list of str): A list of tags associated with the case. - Products (list of str): A list of products associated with the case. Returns an error message if the case is not found, the user lacks permission, or the update is invalid.

    Example Usage: # Update the assignee and priority of a case update_case( project_id='123', region='us', customer_id='abc', case_id='456', assignee='new _user@example.com' , priority='PRIORITY_CRITICAL' )

     # Change the stage and add a description
        update_case(
            project_id='123',
            region='us',
            customer_id='abc',
            case_id='789',
            stage='Investigation',
            description='Escalated for further investigation due to new IOCs.'
        )

        # Mark as important
        update_case(
            project_id='123',
            region='us',
            customer_id='abc',
            case_id='101',
            important=True
        )

    Next Steps (using MCP-enabled tools): - Use 'get_case' with the case's resource name to verify that the case has been updated correctly. - Use 'list_case_comments' to see if any comments were added as part of the update. - Use 'create_case_comment' to add a note explaining why the case was updated.

    The following sample demonstrate how to use curl to invoke the update_case MCP tool.

    Curl Request 
      
curl  
--location  
 'https://chronicle.googleapis.com/mcp' 
  
 \ 
--header  
 'content-type: application/json' 
  
 \ 
--header  
 'accept: application/json, text/event-stream' 
  
 \ 
--data  
 '{ 
 "method": "tools/call", 
 "params": { 
 "name": "update_case", 
 "arguments": { 
 // provide these details according to the tool' 
s  
MCP  
specification  
 } 
  
 } 
,  
 "jsonrpc" 
:  
 "2.0" 
,  
 "id" 
:  
 1 
 } 
 '

    Input Schema

    Request message for UpdateCase. Next ID: 21

    UpdateCaseRequest

    JSON representation 
     { 
 "projectId" 
 : 
 string 
 , 
 "customerId" 
 : 
 string 
 , 
 "region" 
 : 
 string 
 , 
 "caseId" 
 : 
 string 
 , 
 "tags" 
 : 
 [ 
 { 
 object (  CaseTag 
 
) 
 } 
 ] 
 , 
 "products" 
 : 
 [ 
 { 
 object (  CaseProduct 
 
) 
 } 
 ] 
 , 
 // Union field _display_name 
can be only one of the following: 
 "displayName" 
 : 
 string 
 // End of list of possible types for union field _display_name 
. 
 // Union field _stage 
can be only one of the following: 
 "stage" 
 : 
 string 
 // End of list of possible types for union field _stage 
. 
 // Union field _priority 
can be only one of the following: 
 "priority" 
 : 
 enum ( Priority 
) 
 // End of list of possible types for union field _priority 
. 
 // Union field _important 
can be only one of the following: 
 "important" 
 : 
 boolean 
 // End of list of possible types for union field _important 
. 
 // Union field _incident 
can be only one of the following: 
 "incident" 
 : 
 boolean 
 // End of list of possible types for union field _incident 
. 
 // Union field _assignee 
can be only one of the following: 
 "assignee" 
 : 
 string 
 // End of list of possible types for union field _assignee 
. 
 // Union field _description 
can be only one of the following: 
 "description" 
 : 
 string 
 // End of list of possible types for union field _description 
. 
 // Union field _type 
can be only one of the following: 
 "type" 
 : 
 enum ( CaseType 
) 
 // End of list of possible types for union field _type 
. 
 // Union field _environment 
can be only one of the following: 
 "environment" 
 : 
 string 
 // End of list of possible types for union field _environment 
. 
 // Union field _move_environment 
can be only one of the following: 
 "moveEnvironment" 
 : 
 { 
 object (  MoveEnvironment 
 
) 
 } 
 // End of list of possible types for union field _move_environment 
. 
 // Union field _score 
can be only one of the following: 
 "score" 
 : 
 number 
 // End of list of possible types for union field _score 
. 
 // Union field _sla 
can be only one of the following: 
 "sla" 
 : 
 { 
 object (  Sla 
 
) 
 } 
 // End of list of possible types for union field _sla 
. 
 // Union field _involved_suspicious_entity 
can be only one of the following: 
 "involvedSuspiciousEntity" 
 : 
 boolean 
 // End of list of possible types for union field _involved_suspicious_entity 
. 
 // Union field _closure_details 
can be only one of the following: 
 "closureDetails" 
 : 
 { 
 object (  CaseClosureDetails 
 
) 
 } 
 // End of list of possible types for union field _closure_details 
. 
 }
    Fields
    projectId

    string

    Project ID of the customer.

    customerId

    string

    Customer ID of the customer.

    region

    string

    Region of the customer.

    caseId

    string

    Case ID of the case to update.

    tags[]

    object ( CaseTag )

    CaseTags associated with the case.

    products[]

    object ( CaseProduct )

    Products associated with the case.

    Union field _display_name .

    _display_name can be only one of the following:

    displayName

    string

    Case to update.

    Union field _stage .

    _stage can be only one of the following:

    stage

    string

    The stage of the Case. For example, "Triage", "Incident", "Investigation". Stages are defined in "chronicle.googleapis.com/CaseStageDefinition". The default stage option is "Triage".

    Union field _priority .

    _priority can be only one of the following:

    priority

    enum ( Priority )

    Default value is HIGH. Case priority. For example, "Informative", "Low", "Medium", "High", "Critical".

    Union field _important .

    _important can be only one of the following:

    important

    boolean

    Additional way to specify case importance. The default is false.

    Union field _incident .

    _incident can be only one of the following:

    incident

    boolean

    Additional way to specify if the case marked as incident. The default is false.

    Union field _assignee .

    _assignee can be only one of the following:

    assignee

    string

    This can be a user or a @SocRole, default value is the default soc-role defined in Settings.

    Union field _description .

    _description can be only one of the following:

    description

    string

    Case description. Limit chars to 1000.

    Union field _type .

    _type can be only one of the following:

    type

    enum ( CaseType )

    Case type

    Union field _environment .

    _environment can be only one of the following:

    environment

    string

    Case environment.

    Union field _move_environment .

    _move_environment can be only one of the following:

    moveEnvironment

    object ( MoveEnvironment )

    Case environment move details.

    Union field _score .

    _score can be only one of the following:

    score

    number

    Attack exposure score, how risky the case.

    Union field _sla .

    _sla can be only one of the following:

    sla

    object ( Sla )

    SLA for the case.

    Union field _involved_suspicious_entity .

    _involved_suspicious_entity can be only one of the following:

    involvedSuspiciousEntity

    boolean

    If has involved suspicious entity in the case.

    Union field _closure_details .

    _closure_details can be only one of the following:

    closureDetails

    object ( CaseClosureDetails )

    Case closure details.

    MoveEnvironment

    JSON representation 
     { 
 "shouldDeleteOldCase" 
 : 
 boolean 
 }
    Fields
    shouldDeleteOldCase

    boolean

    Optional. If the case should be deleted on move to the new environment.

    Sla

    JSON representation 
     { 
 "expirationTime" 
 : 
 string 
 , 
 "criticalExpirationTime" 
 : 
 string 
 , 
 "expirationStatus" 
 : 
 enum ( SlaExpirationStatus 
) 
 , 
 "remainingTimeSinceLastPause" 
 : 
 integer 
 }
    Fields
    expirationTime

    string ( int64 format)

    Required. SLA expiration time in unix format as milliseconds. Old prop: SlaExpiration.
    criticalExpirationTime

    string ( int64 format)

    Required. SLA critical expiration time in unix format as milliseconds, old prop: SlaCriticalExpiration.
    expirationStatus

    enum ( SlaExpirationStatus )

    Output only. SLA expiration status.
    remainingTimeSinceLastPause

    integer

    Output only. Remaining time since last pause.

    CaseTag

    JSON representation 
     { 
 "displayName" 
 : 
 string 
 , 
 "alert" 
 : 
 string 
 , 
 // Union field _priority 
can be only one of the following: 
 "priority" 
 : 
 integer 
 // End of list of possible types for union field _priority 
. 
 }
    Fields
    displayName

    string

    Output only. The name of the tag

    alert

    string

    Output only. For tags set by playbook action, this is relevant during MoveAlert. Replaces old property: "Indicator".

    Union field _priority .

    _priority can be only one of the following:

    priority

    integer

    Output only. During ingestion if more than one tag matches the criteria, the one with the priority will be chosen. Available options: 1-5.

    CaseProduct

    JSON representation 
     { 
 "displayName" 
 : 
 string 
 , 
 "alert" 
 : 
 string 
 }
    Fields
    displayName

    string

    Output only. Display name of the product.
    alert

    string

    Output only. Replaces old property: "AlertIdentifier".

    CaseClosureDetails

    JSON representation 
     { 
 "reason" 
 : 
 enum ( CloseReason 
) 
 , 
 "rootCause" 
 : 
 string 
 , 
 "caseClosedAction" 
 : 
 enum ( CaseClosedAction 
) 
 , 
 "comment" 
 : 
 string 
 }
    Fields
    reason

    enum ( CloseReason )

    Output only. Case closure reason.
    rootCause

    string

    Output only. Case closure root cause.
    caseClosedAction

    enum ( CaseClosedAction )

    Output only. Case closed action.
    comment

    string

    Output only. Case closure comment.

    Output Schema

    This service is available for customers who migrated SOAR to a customer managed project and have the Chronicle API enabled. Cases provides analysts a way to investigate incoming security alerts and safeguard workstations. Cases are generated by alerts from the SIEM platform. Further alerts linked to the same entities may be grouped into an existing case based on a flexible configuration. In addition, analysts can create manual cases and simulated cases and ingest specific data.

    Case

    JSON representation 
     { 
 "name" 
 : 
 string 
 , 
 "creatorUserId" 
 : 
 string 
 , 
 "creatorUser" 
 : 
 string 
 , 
 "lastModifyingUserId" 
 : 
 string 
 , 
 "lastModifyingUser" 
 : 
 string 
 , 
 "createTime" 
 : 
 string 
 , 
 "updateTime" 
 : 
 string 
 , 
 "displayName" 
 : 
 string 
 , 
 "alertCount" 
 : 
 integer 
 , 
 "stage" 
 : 
 string 
 , 
 "priority" 
 : 
 enum ( Priority 
) 
 , 
 "assignee" 
 : 
 string 
 , 
 "assignedUser" 
 : 
 string 
 , 
 "description" 
 : 
 string 
 , 
 "type" 
 : 
 enum ( CaseType 
) 
 , 
 "environment" 
 : 
 string 
 , 
 "moveEnvironment" 
 : 
 { 
 object (  MoveEnvironment 
 
) 
 } 
 , 
 "status" 
 : 
 enum ( CaseStatus 
) 
 , 
 "score" 
 : 
 number 
 , 
 "workflowStatus" 
 : 
 enum ( WorkflowStatus 
) 
 , 
 "sla" 
 : 
 { 
 object (  Sla 
 
) 
 } 
 , 
 "alertsSla" 
 : 
 { 
 object (  Sla 
 
) 
 } 
 , 
 "source" 
 : 
 string 
 , 
 "tags" 
 : 
 [ 
 { 
 object (  CaseTag 
 
) 
 } 
 ] 
 , 
 "products" 
 : 
 [ 
 { 
 object (  CaseProduct 
 
) 
 } 
 ] 
 , 
 "closureDetails" 
 : 
 { 
 object (  CaseClosureDetails 
 
) 
 } 
 , 
 "tasks" 
 : 
 [ 
 { 
 object (  Task 
 
) 
 } 
 ] 
 , 
 // Union field _important 
can be only one of the following: 
 "important" 
 : 
 boolean 
 // End of list of possible types for union field _important 
. 
 // Union field _incident 
can be only one of the following: 
 "incident" 
 : 
 boolean 
 // End of list of possible types for union field _incident 
. 
 // Union field _overflow_case 
can be only one of the following: 
 "overflowCase" 
 : 
 boolean 
 // End of list of possible types for union field _overflow_case 
. 
 // Union field _involved_suspicious_entity 
can be only one of the following: 
 "involvedSuspiciousEntity" 
 : 
 boolean 
 // End of list of possible types for union field _involved_suspicious_entity 
. 
 }
    Fields
    name

    string

    Identifier. The unique name(ID) of the Case. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}

    creatorUserId

    string

    Output only. Case creator id. Used for homepage/requests feature.

    creatorUser

    string

    Output only. Resource association for the creator.

    lastModifyingUserId

    string

    Output only. Last user who modified the case. replaced old property name: LastModifyingUser.

    lastModifyingUser

    string

    Output only. Resource association for the modifying user.

    createTime

    string ( int64 format)

    Output only. The creation time of the record in milliseconds.

    updateTime

    string ( int64 format)

    Output only. The modification time of the record in milliseconds.

    displayName

    string

    Required. Case title, limited to 200 characters. Replaces old property: Title.

    alertCount

    integer

    Output only. Alerts in case.

    stage

    string

    Required. The stage of the Case. For example, "Triage", "Incident", "Investigation". Stages are defined in "chronicle.googleapis.com/CaseStageDefinition". The default stage option is "Triage".

    priority

    enum ( Priority )

    Required. Default value is HIGH. Case priority. For example, "Informative", "Low", "Medium", "High", "Critical".

    assignee

    string

    Optional. This can be a user or a @SocRole, default value is the default soc-role defined in Settings.

    assignedUser

    string

    Output only. Resource association for the assignee.

    description

    string

    Optional. Case description. Limit chars to 1000.

    type

    enum ( CaseType )

    Required. Case type.

    environment

    string

    Required. Case logical environments.

    moveEnvironment

    object ( MoveEnvironment )

    Optional. Case environment move details.

    status

    enum ( CaseStatus )

    Output only. Case data status.

    score

    number

    Optional. Attack exposure score, how risky the case.

    workflowStatus

    enum ( WorkflowStatus )

    Output only. Case playbook status.

    sla

    object ( Sla )

    Optional. SLA for the case.

    alertsSla

    object ( Sla )

    Optional. Aggregated alerts SLA. (alert has SLA as well).

    source

    string

    Output only. The source that created the case. Possible values: "Server", "User", "Simulated", "Merge", "AlertMove"

    tags[]

    object ( CaseTag )

    Optional. CaseTags associated with the case.

    products[]

    object ( CaseProduct )

    Optional. Products associated with the case. Contains Name of product (e.g. WinEventLog:Security/DLP_Product). Replaces old property: "Product".

    closureDetails

    object ( CaseClosureDetails )

    Optional. Case closure details.

    tasks[]

    object ( Task )

    Output only. Tasks associated with the case.

    Union field _important .

    _important can be only one of the following:

    important

    boolean

    Optional. Additional way to specify case importance. The default is false.

    Union field _incident .

    _incident can be only one of the following:

    incident

    boolean

    Optional. Additional way to specify if the case marked as incident. The default is false.

    Union field _overflow_case .

    _overflow_case can be only one of the following:

    overflowCase

    boolean

    Output only. Case without events, was reduced by the connector service due to a large amount of data. During ingestion if the "alert package" crosses a specific threshold, the alert will be trimmed due to security reasons (DDOS attacks, etc..)

    Union field _involved_suspicious_entity .

    _involved_suspicious_entity can be only one of the following:

    involvedSuspiciousEntity

    boolean

    Optional. If has involved suspicious entity in the case.

    MoveEnvironment

    JSON representation 
     { 
 "shouldDeleteOldCase" 
 : 
 boolean 
 }
    Fields
    shouldDeleteOldCase

    boolean

    Optional. If the case should be deleted on move to the new environment.

    Sla

    JSON representation 
     { 
 "expirationTime" 
 : 
 string 
 , 
 "criticalExpirationTime" 
 : 
 string 
 , 
 "expirationStatus" 
 : 
 enum ( SlaExpirationStatus 
) 
 , 
 "remainingTimeSinceLastPause" 
 : 
 integer 
 }
    Fields
    expirationTime

    string ( int64 format)

    Required. SLA expiration time in unix format as milliseconds. Old prop: SlaExpiration.
    criticalExpirationTime

    string ( int64 format)

    Required. SLA critical expiration time in unix format as milliseconds, old prop: SlaCriticalExpiration.
    expirationStatus

    enum ( SlaExpirationStatus )

    Output only. SLA expiration status.
    remainingTimeSinceLastPause

    integer

    Output only. Remaining time since last pause.

    CaseTag

    JSON representation 
     { 
 "displayName" 
 : 
 string 
 , 
 "alert" 
 : 
 string 
 , 
 // Union field _priority 
can be only one of the following: 
 "priority" 
 : 
 integer 
 // End of list of possible types for union field _priority 
. 
 }
    Fields
    displayName

    string

    Output only. The name of the tag

    alert

    string

    Output only. For tags set by playbook action, this is relevant during MoveAlert. Replaces old property: "Indicator".

    Union field _priority .

    _priority can be only one of the following:

    priority

    integer

    Output only. During ingestion if more than one tag matches the criteria, the one with the priority will be chosen. Available options: 1-5.

    CaseProduct

    JSON representation 
     { 
 "displayName" 
 : 
 string 
 , 
 "alert" 
 : 
 string 
 }
    Fields
    displayName

    string

    Output only. Display name of the product.
    alert

    string

    Output only. Replaces old property: "AlertIdentifier".

    CaseClosureDetails

    JSON representation 
     { 
 "reason" 
 : 
 enum ( CloseReason 
) 
 , 
 "rootCause" 
 : 
 string 
 , 
 "caseClosedAction" 
 : 
 enum ( CaseClosedAction 
) 
 , 
 "comment" 
 : 
 string 
 }
    Fields
    reason

    enum ( CloseReason )

    Output only. Case closure reason.
    rootCause

    string

    Output only. Case closure root cause.
    caseClosedAction

    enum ( CaseClosedAction )

    Output only. Case closed action.
    comment

    string

    Output only. Case closure comment.

    Task

    JSON representation 
     { 
 "name" 
 : 
 string 
 , 
 "id" 
 : 
 string 
 , 
 "createTime" 
 : 
 string 
 , 
 "updateTime" 
 : 
 string 
 , 
 "content" 
 : 
 string 
 , 
 "dueTime" 
 : 
 string 
 , 
 "title" 
 : 
 string 
 , 
 "author" 
 : 
 string 
 , 
 "lastAuthor" 
 : 
 string 
 , 
 "assignee" 
 : 
 string 
 , 
 "status" 
 : 
 enum ( Status 
) 
 , 
 "resolver" 
 : 
 string 
 , 
 "comment" 
 : 
 string 
 , 
 "resolutionTime" 
 : 
 string 
 , 
 "caseId" 
 : 
 integer 
 , 
 // Union field _favorite 
can be only one of the following: 
 "favorite" 
 : 
 boolean 
 // End of list of possible types for union field _favorite 
. 
 }
    Fields
    name

    string

    Identifier. The unique name(ID) of the task. Format: projects/{project}/locations/{location}/instances/{instance}/tasks/{task}

    id

    string ( int64 format)

    Output only. The unique ID of the task.

    createTime

    string ( int64 format)

    Output only. The creation time of the task.

    updateTime

    string ( int64 format)

    Output only. The last update time of the task.

    content

    string

    Required. The task content, limited to 4096 characters.

    dueTime

    string ( int64 format)

    Optional. The due time for the task in ms. When specified during task creation, must be in the future. Is optional as deadlines can exist without a specific scheduled time.

    title

    string

    Required. The task title, minimum length of 3 characters and maximum of 50 characters.

    author

    string

    Output only. The user who created the task.

    lastAuthor

    string

    Output only. The last editor of the task.

    assignee

    string

    Required. The assignee of the task.

    status

    enum ( Status )

    Required. The status of the task. todo change to task startus enum

    resolver

    string

    Output only. The user who resolved the task.

    comment

    string

    Required. Comment added during task resolution, limited to 4096 characters.

    resolutionTime

    string ( int64 format)

    Output only. The resolution time of the task in ms.

    caseId

    integer ( uint32 format)

    Optional. Associated case id (if task is related to a specific case) Can be optional as tasks may exist independently or be associated with a specific case.

    Union field _favorite .

    _favorite can be only one of the following:

    favorite

    boolean

    Optional. Determines whether the task is marked as favorite.

    Tool Annotations

    Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: