secops-cases
Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle
by googleFree
Description
SecOps case management is an agent skill for running security incident cases in Google Security Operations SOAR. It covers the full case lifecycle: creating a case, monitoring the queue, grouping and linking alerts, taking forensic notes, updating priority and status, and closing a case formally with root-cause tracking. It requires a Google SecOps MCP server, and it checks that the case tools are registered before it does anything else. If they are missing, it stops and reports that. A prompt-injection rule makes it treat case titles, descriptions, alert names, entity values and analyst comments as untrusted data rather than as instructions, so text inside a ticket cannot direct the agent to run commands. It is aimed at security operations analysts and incident responders who want an agent to handle the administrative work of cases while they keep the judgment calls. It is published by Google on skills.sh under the google skills repository, with about 1.5K installs. The skills.sh listing shows Gen Agent Trust Hub and Socket passing, with Snyk showing Warn.…
Highlights
- Create, inspect, update and close SOAR cases
- Queue monitoring and alert grouping
- Forensic notes and root-cause tracking
- Requires a Google SecOps MCP server
- Treats case content as untrusted data
Ratings & Reviews
No ratings yet
Be the first to rate secops-cases.
People also visit
secops-cases FAQ
What does the skill manage?
Google SecOps SOAR cases from creation through to closure, including alerts, notes, priority and status.
What does it need?
A Google SecOps MCP server with the case tools registered. Without them the skill stops and reports that.
How does it handle text in cases?
It treats titles, descriptions, alert names, entity values and comments as data, not instructions.
How do I install it?
Run npx skills add https://github.com/google/skills --skill secops-cases.
What are the best secops-cases alternatives?
Popular alternatives to secops-cases include secops-detection-engineering, debugging-and-error-recovery and memory-forensics. See all secops-cases alternatives