domains / families / security / secops-cases

secops-cases

separate

Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR cases; adding investigative comments and notes; updating case priority or description; or linking and grouping security alerts within cases. Supports both remote Google SecOps MCP tools and local fallback tools. Don't use for SIEM UDM searches or detection rule authoring.

When to use

• listing SOAR cases
• creating SOAR cases
• inspecting case details
• updating case priority or description
• closing SOAR cases
• adding investigative comments and notes
• linking and grouping security alerts within cases

When not to use

• SIEM UDM searches
• detection rule authoring

Skill page

Source