> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google SecOps SOAR

> Reference for the Tracecat Google SecOps SOAR integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Add case tag

Action ID: `tools.google_secops_soar.add_case_tag`

Add a tag to a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_id" type="integer" required>
  The case ID
</ParamField>

<ParamField path="tag" type="string" required>
  Tag to add to the case
</ParamField>

<ParamField path="alert_identifier" type="string | null">
  Optional alert identifier within the case

  Default: `null`.
</ParamField>

## Assign user to case

Action ID: `tools.google_secops_soar.assign_user_to_case`

Assign a user or SOC role to a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_id" type="integer" required>
  The case ID
</ParamField>

<ParamField path="user_id" type="string" required>
  User ID (GUID) or @RoleName to assign
</ParamField>

<ParamField path="alert_identifier" type="string | null">
  Optional alert identifier within the case

  Default: `null`.
</ParamField>

## Bulk close cases

Action ID: `tools.google_secops_soar.bulk_close_cases`

Close multiple Chronicle SOAR cases in a single operation.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_ids" type="array[integer]" required>
  List of case IDs to close
</ParamField>

<ParamField path="close_comment" type="string" required>
  Comment for all closed cases
</ParamField>

<ParamField path="close_reason" type="integer" required>
  Close reason enum: 0=Malicious, 1=NotMalicious, 2=Maintenance, 3=Inconclusive, 4=Unknown
</ParamField>

<ParamField path="root_cause" type="string" required>
  Root cause description
</ParamField>

## Change case stage

Action ID: `tools.google_secops_soar.change_case_stage`

Change the stage of a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_id" type="integer" required>
  The case ID
</ParamField>

<ParamField path="stage" type="string" required>
  New stage: Triage, Assessment, Investigation, Incident, Improvement, or Research
</ParamField>

## Close alert

Action ID: `tools.google_secops_soar.close_alert`

Close a specific alert within a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="alert_identifier" type="string" required>
  The alert identifier to close
</ParamField>

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="comment" type="string" required>
  Comment explaining why the alert is being closed
</ParamField>

<ParamField path="reason" type="string" required>
  Close reason: Malicious, NotMalicious, Maintenance, or Inconclusive
</ParamField>

<ParamField path="root_cause" type="string" required>
  Root cause description
</ParamField>

<ParamField path="source_case_id" type="integer" required>
  The case ID where the alert is being closed
</ParamField>

<ParamField path="usefulness" type="string">
  Alert usefulness: None, NotUseful, or Useful

  Default: `"None"`.
</ParamField>

## Create case comment

Action ID: `tools.google_secops_soar.create_case_comment`

Add a comment to a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_id" type="integer" required>
  The case ID
</ParamField>

<ParamField path="comment" type="string" required>
  Comment text to add to the case
</ParamField>

<ParamField path="alert_identifier" type="string | null">
  Optional alert identifier

  Default: `null`.
</ParamField>

<ParamField path="base64_blob" type="string | null">
  Optional base64-encoded file content

  Default: `null`.
</ParamField>

<ParamField path="file_name" type="string | null">
  Optional attachment filename

  Default: `null`.
</ParamField>

<ParamField path="file_type" type="string | null">
  Optional file type (e.g., '.pdf', '.txt')

  Default: `null`.
</ParamField>

## Reopen alert

Action ID: `tools.google_secops_soar.reopen_alert`

Reopen a previously closed alert in a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="alert_identifier" type="string" required>
  The alert identifier to reopen
</ParamField>

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_id" type="integer" required>
  The case ID
</ParamField>

## Search SOAR cases

Action ID: `tools.google_secops_soar.search_cases`

Search Chronicle SOAR cases with advanced filtering.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="assigned_users" type="array[string] | null">
  List of user IDs or @Role names

  Default: `null`.
</ParamField>

<ParamField path="case_ids" type="array[integer] | null">
  List of specific case IDs to retrieve

  Default: `null`.
</ParamField>

<ParamField path="end_time" type="string | null">
  UTC end time (ISO 8601 format). Only used when time\_range\_filter=0 (CUSTOM)

  Default: `null`.
</ParamField>

<ParamField path="environments" type="array[string] | null">
  List of environments to filter by

  Default: `null`.
</ParamField>

<ParamField path="importance" type="array[string] | null">
  Filter by importance: \['True'] for important cases only

  Default: `null`.
</ParamField>

<ParamField path="incident" type="array[string] | null">
  Filter by incident flag: \['True'] for incidents only

  Default: `null`.
</ParamField>

<ParamField path="is_case_closed" type="boolean | null">
  Filter by case status (true=closed, false=open, null=all)

  Default: `null`.
</ParamField>

<ParamField path="page_size" type="integer">
  Number of results per page (max 100)

  Default: `50`.
</ParamField>

<ParamField path="priorities" type="array[string] | null">
  List of priorities: Informative, Low, Medium, High, Critical

  Default: `null`.
</ParamField>

<ParamField path="requested_page" type="integer">
  Page number (0-indexed)

  Default: `0`.
</ParamField>

<ParamField path="stages" type="array[string] | null">
  List of stages: Triage, Assessment, Investigation, Incident, Improvement, Research

  Default: `null`.
</ParamField>

<ParamField path="start_time" type="string | null">
  UTC start time (ISO 8601 format, e.g., '2024-01-01T00:00:00.000Z'). Only used when time\_range\_filter=0 (CUSTOM)

  Default: `null`.
</ParamField>

<ParamField path="tags" type="array[string] | null">
  List of case tags to filter by

  Default: `null`.
</ParamField>

<ParamField path="time_range_filter" type="integer | null">
  Predefined time range in days: 0=CUSTOM, 1=LAST\_DAY, 2=LAST\_2\_DAYS, 3=LAST\_3\_DAYS, 4=LAST\_4\_DAYS, 7=LAST\_WEEK, 14=LAST\_2\_WEEKS, 30=LAST\_MONTH, 90=LAST\_3\_MONTHS, 180=LAST\_6\_MONTHS, 365=LAST\_YEAR, 395=LAST\_13\_MONTHS

  Default: `null`.
</ParamField>

<ParamField path="title" type="string | null">
  Search by case title/name (partial match supported)

  Default: `null`.
</ParamField>

## Update alert priority

Action ID: `tools.google_secops_soar.update_alert_priority`

Update the priority of a specific alert within a case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="alert_identifier" type="string" required>
  The alert identifier
</ParamField>

<ParamField path="alert_name" type="string" required>
  The alert name
</ParamField>

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_id" type="integer" required>
  The case ID
</ParamField>

<ParamField path="priority" type="integer" required>
  New priority: -1=Informative, 40=Low, 60=Medium, 80=High, 100=Critical
</ParamField>

<ParamField path="previous_priority" type="integer">
  Previous priority (0=Unchanged if unknown)

  Default: `0`.
</ParamField>

## Update case comment

Action ID: `tools.google_secops_soar.update_case_comment`

Update an existing comment in a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="comment" type="string" required>
  Updated comment text
</ParamField>

<ParamField path="comment_id" type="integer" required>
  The comment ID to update
</ParamField>

<ParamField path="attachment_id" type="integer | null">
  Optional attachment ID to update

  Default: `null`.
</ParamField>

<ParamField path="base64_blob" type="string | null">
  Optional updated base64-encoded file content

  Default: `null`.
</ParamField>

<ParamField path="file_name" type="string | null">
  Optional updated filename

  Default: `null`.
</ParamField>

<ParamField path="file_type" type="string | null">
  Optional updated file type

  Default: `null`.
</ParamField>

## Update case priority

Action ID: `tools.google_secops_soar.update_case_priority`

Update the priority of a Chronicle SOAR case.

### Secrets

Required secrets:

* `google_secops_soar`: required values `GOOGLE_SECOPS_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Chronicle SOAR API base URL (e.g., '[https://your-instance.siemplify-soar.com/api/external/v1](https://your-instance.siemplify-soar.com/api/external/v1)')
</ParamField>

<ParamField path="case_id" type="integer" required>
  The case ID
</ParamField>

<ParamField path="priority" type="integer" required>
  Priority: -1=Informative, 40=Low, 60=Medium, 80=High, 100=Critical
</ParamField>