Guide · Agent skill
How to use the Google SecOps Case Management agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The secops-cases skill gives an AI agent a set of instructions for working with incident cases in Google Security Operations (Google SecOps SOAR). Once it is installed and the Google SecOps MCP server is connected, the agent can list cases, read case details and linked alerts, add analyst notes, change priority or status, group alerts, and close cases with a root cause. This guide explains what the skill does, how to install it, how to ask for things in plain language, and what to check for safety.
Google SecOps Case Managementgoogle/skills · Apache-2.0 Download the skill Quick start
- 1Connect the MCP server. Connect the google-security-operations MCP server with valid credentials and confirm it shows as connected in your agent client.
- 2Set environment variables. Set PROJECT_ID and CUSTOMER_ID, and optionally REGION, so the skill can pass them to remote tools.
- 3Download the ZIP. Download the secops-cases ZIP from this page and unzip it so the folder contains SKILL.md and references/attribution.md.
- 4Place the skill folder. Copy the unzipped folder into ~/.claude/skills/ for personal use or the project's .claude/skills/ folder for one project, or upload it in Settings → Capabilities → Skills.
- 5Restart the client. Restart the agent client so it registers the MCP tools. A configuration change made mid-session does not take effect until restart.
- 6Ask for a case action. Make a plain-language request such as listing open high-priority cases, and check that the agent returns results from your tenant.
What is an agent skill and what does secops-cases do?
An agent skill is a folder containing a SKILL.md file. The file tells an AI agent when to use the skill and how to carry out tasks in a specific domain. The agent reads the instructions when your request matches the skill's description.
The secops-cases skill covers the case lifecycle in Google SecOps: listing and filtering cases, inspecting a case and its alerts, adding comments, updating priority or description, linking and grouping alerts, and closing a case with root-cause tracking.
The skill does not handle SIEM UDM searches or detection rule authoring. It also states that remote MCP tools cannot create cases, so manual case creation needs the local MCP server or the SOAR UI.
- List and filter cases by status, priority or assignee
- View a case with its linked alerts and involved entities
- Add analyst comments and record remediation steps
- Update priority, status or assignee
- Group related alerts and inspect trigger events
- Close a case with a root cause, reason and tags
What you need before installing
The skill cannot work without a connected Google SecOps MCP server (named google-security-operations) and valid credentials. If the server is not connected, the skill tells the agent to stop and report the problem rather than work around it.
Set the environment variables PROJECT_ID and CUSTOMER_ID. REGION is optional and defaults to "us" if unset. A local Python MCP server is only needed if you want the local fallback tools.
- Google SecOps MCP server (google-security-operations) connected with valid credentials
- Environment variables PROJECT_ID and CUSTOMER_ID; optionally REGION
- Local Python MCP server, only if using local fallback tools
- Ability to run the skill's attribution instructions in references/attribution.md
Install the secops-cases skill
Download the ZIP for this skill from this page and unzip it. The folder contains SKILL.md and references/attribution.md. Place the folder in one of these locations, depending on how you want to use it:
- Personal use across projects: unzip into ~/.claude/skills/
- Single project only: unzip into the project's .claude/skills/ folder
- Claude apps: upload the skill under Settings → Capabilities → Skills
Trigger the skill with natural requests
You do not need to name the skill. The skill's description lists the kinds of requests it covers, so the agent loads it when you ask about SOAR cases, notes, priority, alert grouping or closure. Ask for what you need in plain language and include the case ID where you have one.
Requests that fit the skill include listing open high-priority cases, reviewing one case, or adding a finding to a case. Requests about UDM searches or writing detection rules fall outside it.
- "List my open high-priority cases in Google SecOps."
- "Show me case details and linked alerts for this case ID."
- "Add a comment to this case summarising the phishing triage I just did."
- "Change the priority of this case to Critical and explain why in a note."
Work through a typical case
A common flow is to list the queue, open one case, review its alerts and entities, then record your findings. The skill presents case lists as a markdown table with case ID, title, priority, status, assignee and created time.
When the investigation is finished, ask the agent to close the case. Closing needs a root cause, a reason and tags, so have those ready. The agent treats case text as data, not instructions, and it will not change incident records you have not asked it to change.
- Ask for the queue first to confirm the case ID
- Review alerts and grouped alert identifiers before drawing conclusions
- Post comments as you go so the audit trail is complete
- Confirm the root cause before asking for closure
What people use it for
- Triage a morning queue by listing open cases and sorting by priority
- Review a case's linked alerts and involved users, IPs and hashes before escalating
- Record remediation steps and analyst findings as case comments for the audit trail
- Group related alerts into one case to show a single attack chain
- Close resolved cases with a root cause, reason and tags
Frequently asked questions
Is the secops-cases skill free to use?
The source does not state pricing. The skill is published under the Apache-2.0 licence. You still need a Google SecOps tenant with valid credentials to use it, and any costs for that platform are separate.
What do I need to install the secops-cases skill?
You need the skill folder unzipped into ~/.claude/skills/ or a project's .claude/skills/, or uploaded under Settings → Capabilities → Skills. The skill also requires the google-security-operations MCP server connected with valid credentials, plus PROJECT_ID and CUSTOMER_ID set.
Why does the agent say the MCP server is not connected?
The skill checks for a list_cases tool before doing anything else. If no case tool is registered, it stops and asks you to restart the client with valid credentials and confirm the server is connected. Configuration changes made during a session do not take effect until restart.
Can the skill create a new case in Google SecOps?
Not through the remote MCP server, which exposes no create_case tool. Manual creation requires the local MCP server, which has a create_case tool, or the SOAR UI. Cases are normally created from alert ingestion.
Does the skill run scripts or make network calls?
The source says it does not run scripts and does use the network. It calls the Google SecOps MCP server to read and update cases, so it needs network access to that service.
Is there an alternative if I only want to search logs?
Yes, the skill excludes SIEM UDM searches and detection rule authoring, so use a Google SecOps search or detection workflow for those tasks instead. This skill is only for managing case records.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use secops-cases if you triage and update SOAR cases through an AI agent, already run the Google SecOps MCP server, and want the agent to work under explicit guardrails. Skip it if you have no Google SecOps tenant, need log searching or detection authoring, or want unattended automation that changes live incident records without human review.
Download the skill