GoogleSecOpsCases

Use the Google SecOps Cases integration to retrieve Cases as Incidents. This integration also provides commands to manage the Cases lifecycle.

Analytics & SIEM · Google SecOps

Details

IDGoogleSecOpsCases
ProviderGoogle
CategoryAnalytics & SIEM
From Version6.10.0
Docker Imagedemisto/googleapi-python3:1.0.0.11185775
Supported ModulesAgentix XSIAM

README

Use the Google SecOps Cases integration to retrieve Cases as Incidents. This integration also provides commands to manage the Cases lifecycle.
This integration was integrated and tested with version v1 Alpha of Google SecOps API.

Configure Google SecOps Cases in Cortex

Parameter Description Required
User’s Service Account JSON   True
API URL Format Select the API URL format to use for API requests. Default value is ‘<chronicle>.<REGION>.<rep.googleapis.com>’. False
Google SecOps Project Instance ID Provide the Project Instance ID of the Google SecOps.

Note: User can retrieve the Customer ID(Project Instance ID) in the Profile section of the Google SecOps page.		 True
Google SecOps Project Number Provide the Project Number of the Google SecOps.

Note: User can retrieve the Project Number in the Profile section of the Google SecOps page. If Project Number is not provided, then Project ID(from Service Account JSON) will be used.		 False
Region Select the region based on the location of the Google SecOps instance. If the region is not listed in the dropdown, choose the “Other” option and specify the region in the “Other Region” text field. True
Other Region Specify the region based on the location of the Google SecOps instance. Only applicable if the “Other” option is selected in the Region dropdown. False
Fetch incidents    
Incident type   False
First Fetch Time The UTC date or relative timestamp from where to start fetching incidents. Default is 3 days.

Note: If the value is greater than the past 7 days, it will be considered as past 7 days. The maximum is 7 days.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 01 May 2026 04:45:33, 2026-05-17T14:05:44Z.		 False
How many incidents to fetch each time The maximum number of incidents to fetch in each time. Default is 50.

Note: If the value is greater than 200, it will be considered as 200. The maximum is 200.		 False
Case Priorities Filter cases by priority level. Default is all. False
Case Statuses Filter cases by status. Default is all. False
Case Environments Filter cases by logical environment. False
Case Tags Filter cases by tag name. False
Case Filter Logic Logical operator to combine the case filter parameters. Default is AND. False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gcb-case-list

Retrieve the list of cases.

Base Command

gcb-case-list

Input

Argument Name Description Required
display_name Filter the cases by display name. Supports comma-separated values. Optional
priority Filter the cases by priority. Supports comma-separated values. Possible values are: UNSPECIFIED, INFO, LOW, MEDIUM, HIGH, CRITICAL. Optional
status Filter the cases by status. Supports comma-separated values. Possible values are: OPENED, CLOSED, MERGED, CREATION_PENDING, CASE_DATA_STATE_UNSPECIFIED. Optional
type Filter the cases by type. Supports comma-separated values. Possible values are: EXTERNAL, TEST, REQUEST, CASE_TYPE_UNSPECIFIED. Optional
stage Filter the cases by stage. Supports comma-separated values. Possible values are: Triage, Incident, Investigation. Optional
source Filter the cases by source. Supports comma-separated values. Possible values are: Server, User, Simulated, Merge, AlertMove. Optional
assignee Filter the cases by assignee user email or SOC role. Supports comma-separated values. Optional
environment Filter the cases by environment assigned to the case. Supports comma-separated values. Optional
tags Filter the cases by tag names. Supports comma-separated values. Optional
products Filter the cases by product name. Supports comma-separated values. Optional
important Filter the cases by the importance flag. Possible values are: True, False. Optional
incident Filter the cases by the incident flag. Possible values are: True, False. Optional
workflow_status Filter the cases by playbook or workflow execution status. Supports comma-separated values. Possible values are: NONE, IN_PROGRESS, COMPLETED, FAILED, TERMINATED, PENDING_IN_QUEUE, PENDING_FOR_USER, WORKFLOW_STATUS_UNSPECIFIED. Optional
sla Filter the cases by SLA expiration status. Supports comma-separated values. Possible values are: OPEN_SLA, PASSED_DUE, NO_SLA, CRITICAL_EXPIRED, PAUSED, SLA_EXPIRATION_STATUS_UNSPECIFIED. Optional
alerts_sla Filter the cases by the aggregated alerts SLA expiration status. Supports comma-separated values. Possible values are: OPEN_SLA, PASSED_DUE, NO_SLA, CRITICAL_EXPIRED, PAUSED, SLA_EXPIRATION_STATUS_UNSPECIFIED. Optional
create_start_time Filter the cases created on or after this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
create_end_time Filter the cases created on or before this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
update_start_time Filter the cases updated on or after this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
update_end_time Filter the cases updated on or before this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
advanced_filter Specify a raw AIP-160 filter string for advanced conditions. When provided, all other individual filter arguments are ignored.

Supported values: displayName, creatorUserId, creatorUser, assignee, stage, status, priority, important, type, environment, score, alertsSla.expirationStatus, sla.expirationStatus, tags, products, closureDetails, tasks, workflowStatus, createTime, updateTime

Example: (priority=”PRIORITY_HIGH” OR status=”OPENED”) AND stage=”Investigation”.		 Optional
page_size Specify the maximum number of cases to return.

Note: Maximum value is 1000. Default is 50.		 Optional
page_token Specify the page token for pagination.

Note: Use the next_page_token from a previous gcb-case-list response.		 Optional
sort_by Specify the field to sort results by. Possible values are: displayName, priority, stage, status, score, createTime, updateTime, assignee, environment, type, sla.expirationTime, alertsSla.expirationTime, sla.expirationStatus, alertsSla.expirationStatus, workflowStatus. Default is createTime. Optional
sort_order Specify the sort direction for the results. Possible values are: Asc, Desc. Default is Desc. Optional
filter_logic Specify the logical operator to combine filter conditions. Possible values are: AND, OR. Default is AND. Optional

Context Output

Path Type Description
GoogleSecOps.Case.name String The unique resource name of the Case.
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.displayName String The title of the Case.
GoogleSecOps.Case.creatorUserId String The ID of the user who created the Case.
GoogleSecOps.Case.lastModifyingUserId String The ID of the user who last modified the Case.
GoogleSecOps.Case.createTime String The creation time of the Case (unix epoch milliseconds).
GoogleSecOps.Case.updateTime String The last update time of the Case (unix epoch milliseconds).
GoogleSecOps.Case.alertCount Number The number of alerts linked to the Case.
GoogleSecOps.Case.stage String The current workflow stage of the Case.
GoogleSecOps.Case.priority String The priority of the Case.
GoogleSecOps.Case.assignee String The assigned user or SOC role of the Case.
GoogleSecOps.Case.description String The description of the Case.
GoogleSecOps.Case.type String The type of the Case.
GoogleSecOps.Case.environment String The logical environment of the Case.
GoogleSecOps.Case.status String The status of the Case.
GoogleSecOps.Case.score Number The attack exposure score of the Case.
GoogleSecOps.Case.workflowStatus String The playbook or workflow status of the Case.
GoogleSecOps.Case.source String The source that created the Case.
GoogleSecOps.Case.important Boolean Whether the Case is marked as important.
GoogleSecOps.Case.incident Boolean Whether the Case is marked as an incident.
GoogleSecOps.Case.overflowCase Boolean Whether the Case is an overflow case due to large data volume.
GoogleSecOps.Case.involvedSuspiciousEntity Boolean Whether a suspicious entity is involved in the Case.
GoogleSecOps.Case.sla.expirationTime String The SLA expiration time of the Case (unix ms).
GoogleSecOps.Case.sla.criticalExpirationTime String The SLA critical expiration time of the Case (unix ms).
GoogleSecOps.Case.sla.expirationStatus String The SLA expiration status of the Case.
GoogleSecOps.Case.sla.remainingTimeSinceLastPause Number The remaining time since the last SLA pause of the Case.
GoogleSecOps.Case.alertsSla.expirationTime String The aggregated alerts SLA expiration time of the Case (unix ms).
GoogleSecOps.Case.alertsSla.criticalExpirationTime String The aggregated alerts SLA critical expiration time of the Case (unix ms).
GoogleSecOps.Case.alertsSla.expirationStatus String The aggregated alerts SLA expiration status.
GoogleSecOps.Case.alertsSla.remainingTimeSinceLastPause Number The remaining time since the last alerts SLA pause of the Case.
GoogleSecOps.Case.tags.displayName String The display name of the tag.
GoogleSecOps.Case.tags.priority Number The priority order of the tag.
GoogleSecOps.Case.products.displayName String The display name of the product.
GoogleSecOps.Case.products.alert String The resource name of the alert associated with the product.
GoogleSecOps.Case.tasks.id String The ID of the task.
GoogleSecOps.Case.tasks.title String The title of the task.
GoogleSecOps.Case.tasks.content String The content/description of the task.
GoogleSecOps.Case.tasks.status String The status of the task.
GoogleSecOps.Case.tasks.assignee String The assignee of the task.
GoogleSecOps.Case.tasks.author String The author who created the task.
GoogleSecOps.Case.tasks.lastAuthor String The last user who modified the task.
GoogleSecOps.Case.tasks.createTime String The creation time of the task (unix epoch milliseconds).
GoogleSecOps.Case.tasks.updateTime String The last update time of the task (unix epoch milliseconds).
GoogleSecOps.Case.tasks.caseId Number The ID of the Case the task belongs to.
GoogleSecOps.Case.tasks.favorite Boolean Whether the task is marked as a favorite.
GoogleSecOps.Case.closureDetails.reason String The closure reason of the Case.
GoogleSecOps.Case.closureDetails.comment String The closure comment of the Case.
GoogleSecOps.Case.closureDetails.rootCause String The root cause provided at closure.
GoogleSecOps.Case.closureDetails.caseClosedAction String The action taken when the Case was closed.
GoogleSecOps.PageToken.command String The command name associated with the pagination token.
GoogleSecOps.PageToken.nextPageToken String The token to retrieve the next page of Cases.
GoogleSecOps.PageToken.totalSize Number The total number of cases available.

Command example

!gcb-case-list page_size=10 priority="HIGH,CRITICAL" status=OPENED stage=Triage assignee=@SOC sort_by=createTime sort_order=Desc

Context Example

{
    "GoogleSecOps": {
        "Case": [
            {
                "name": "projects/chronicle-mock-proj/locations/us/instances/00000000-0000-0000-0000-000000000001/cases/1001",
                "caseId": "1001",
                "displayName": "Test Case 1",
                "lastModifyingUserId": "00000000-0000-0000-0000-000000000002",
                "createTime": "1778778979232",
                "updateTime": "1779426987796",
                "alertCount": 15,
                "stage": "Triage",
                "priority": "PRIORITY_MEDIUM",
                "assignee": "@Tier1",
                "type": "EXTERNAL",
                "environment": "Default Environment",
                "status": "OPENED",
                "workflowStatus": "PENDING_FOR_USER",
                "source": "Server",
                "important": false,
                "incident": false,
                "overflowCase": false,
                "involvedSuspiciousEntity": false,
                "sla": {
                    "expirationTime": "1780832620238",
                    "criticalExpirationTime": "1780580620238",
                    "expirationStatus": "OPEN_SLA"
                },
                "alertsSla": {
                    "expirationTime": "1782774000000",
                    "expirationStatus": "OPEN_SLA"
                },
                "tags": [
                    {
                        "displayName": "demo 1",
                        "priority": 0
                    },
                    {
                        "displayName": "demo 2",
                        "priority": 1
                    }
                ],
                "products": [
                    {
                        "displayName": "Test Case",
                        "alert": "alert 1"
                    },
                    {
                        "displayName": "Test Case",
                        "alert": "alert 2"
                    }
                ],
                "tasks": [
                    {
                        "id": "3",
                        "createTime": "1779447705049",
                        "updateTime": "1779447705049",
                        "content": "Testing",
                        "title": "XSOAR testing",
                        "author": "00000000-0000-0000-0000-000000000001",
                        "lastAuthor": "00000000-0000-0000-0000-000000000002",
                        "assignee": "00000000-0000-0000-0000-000000000001",
                        "status": "PENDING",
                        "favorite": false,
                        "caseId": 1001
                    }
                ],
                "closureDetails": {
                    "reason": "NOT_MALICIOUS",
                    "rootCause": "False positive from detection rule",
                    "caseClosedAction": "MANUALLY",
                    "comment": "Reviewed and confirmed benign activity.\n Case closed by Siemplify API. \nAll attached playbooks and playbook blocks have been terminated.\nAll Alerts were closed."
                }
            },
            {
                "name": "projects/chronicle-mock-proj/locations/us/instances/00000000-0000-0000-0000-000000000001/cases/1002",
                "caseId": "1002",
                "displayName": "Test Case 2",
                "lastModifyingUserId": "00000000-0000-0000-0000-000000000003",
                "createTime": "1778714179967",
                "updateTime": "1779416182426",
                "alertCount": 5,
                "stage": "Investigation",
                "priority": "PRIORITY_HIGH",
                "assignee": "00000000-0000-0000-0000-000000000004",
                "type": "EXTERNAL",
                "environment": "Production",
                "status": "OPENED",
                "workflowStatus": "IN_PROGRESS",
                "source": "Agent",
                "important": true,
                "incident": false,
                "overflowCase": false,
                "involvedSuspiciousEntity": true,
                "sla": {
                    "expirationStatus": "NO_SLA"
                },
                "alertsSla": {
                    "expirationStatus": "NO_SLA"
                },
                "tags": [
                    {
                        "displayName": "critical",
                        "priority": 0
                    }
                ],
                "products": [
                    {
                        "displayName": "Test Product",
                        "alert": "alert 3"
                    }
                ]
            }
        ],
        "PageToken": {
            "command": "gcb-case-list",
            "nextPageToken": "next_page_token_value",
            "totalSize": 2
        }
    }
}

Human Readable Output

Case List

Case ID Display Name Priority Status Stage Environment Workflow Status Assignee Tags SLA Alert Count Create Time
1001 Test Case 1 MEDIUM OPENED Triage Default Environment PENDING_FOR_USER @Tier1 - displayName: demo 1
priority: 0
- displayName: demo 2
priority: 1		 Status: OPEN_SLA
Expiration Time: 2026-06-07 11:43:40 UTC
Critical Expiration Time: 2026-06-04 13:43:40 UTC		 15 2026-05-14 17:16:19 UTC
1002 Test Case 2 HIGH OPENED Investigation Production IN_PROGRESS 00000000-0000-0000-0000-000000000004 - displayName: critical
priority: 0		 Status: NO_SLA 5 2026-05-13 23:16:19 UTC

Maximum number of cases specified in page_size has been returned. To fetch the next set of cases, execute the command with the page token as next_page_token_value.

gcb-case-get

Retrieve a specific case by its ID.

Base Command

gcb-case-get

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required

Context Output

Path Type Description
GoogleSecOps.Case.name String The unique resource name of the Case.
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.displayName String The title of the Case.
GoogleSecOps.Case.creatorUserId String The ID of the user who created the Case.
GoogleSecOps.Case.lastModifyingUserId String The ID of the user who last modified the Case.
GoogleSecOps.Case.createTime String The creation time of the Case (unix epoch milliseconds).
GoogleSecOps.Case.updateTime String The last update time of the Case (unix epoch milliseconds).
GoogleSecOps.Case.alertCount Number The number of alerts linked to the Case.
GoogleSecOps.Case.stage String The current workflow stage of the Case.
GoogleSecOps.Case.priority String The priority of the Case.
GoogleSecOps.Case.assignee String The assigned user or SOC role of the Case.
GoogleSecOps.Case.description String The description of the Case.
GoogleSecOps.Case.type String The type of the Case.
GoogleSecOps.Case.environment String The logical environment of the Case.
GoogleSecOps.Case.status String The status of the Case.
GoogleSecOps.Case.score Number The attack exposure score of the Case.
GoogleSecOps.Case.workflowStatus String The playbook or workflow status of the Case.
GoogleSecOps.Case.source String The source that created the Case.
GoogleSecOps.Case.important Boolean Whether the Case is marked as important.
GoogleSecOps.Case.incident Boolean Whether the Case is marked as an incident.
GoogleSecOps.Case.overflowCase Boolean Whether the Case is an overflow case due to large data volume.
GoogleSecOps.Case.involvedSuspiciousEntity Boolean Whether a suspicious entity is involved in the Case.
GoogleSecOps.Case.sla.expirationTime String The SLA expiration time of the Case (unix ms).
GoogleSecOps.Case.sla.criticalExpirationTime String The SLA critical expiration time of the Case (unix ms).
GoogleSecOps.Case.sla.expirationStatus String The SLA expiration status of the Case.
GoogleSecOps.Case.sla.remainingTimeSinceLastPause Number The remaining time since the last SLA pause of the Case.
GoogleSecOps.Case.alertsSla.expirationTime String The aggregated alerts SLA expiration time of the Case (unix ms).
GoogleSecOps.Case.alertsSla.criticalExpirationTime String The aggregated alerts SLA critical expiration time of the Case (unix ms).
GoogleSecOps.Case.alertsSla.expirationStatus String The aggregated alerts SLA expiration status.
GoogleSecOps.Case.alertsSla.remainingTimeSinceLastPause Number The remaining time since the last alerts SLA pause of the Case.
GoogleSecOps.Case.tags.displayName String The display name of the tag.
GoogleSecOps.Case.tags.priority Number The priority order of the tag.
GoogleSecOps.Case.products.displayName String The display name of the product.
GoogleSecOps.Case.products.alert String The resource name of the alert associated with the product.
GoogleSecOps.Case.tasks.id String The ID of the task.
GoogleSecOps.Case.tasks.title String The title of the task.
GoogleSecOps.Case.tasks.content String The content/description of the task.
GoogleSecOps.Case.tasks.status String The status of the task.
GoogleSecOps.Case.tasks.assignee String The assignee of the task.
GoogleSecOps.Case.tasks.author String The author who created the task.
GoogleSecOps.Case.tasks.lastAuthor String The last user who modified the task.
GoogleSecOps.Case.tasks.createTime String The creation time of the task (unix epoch milliseconds).
GoogleSecOps.Case.tasks.updateTime String The last update time of the task (unix epoch milliseconds).
GoogleSecOps.Case.tasks.caseId Number The ID of the Case the task belongs to.
GoogleSecOps.Case.tasks.favorite Boolean Whether the task is marked as a favorite.
GoogleSecOps.Case.closureDetails.reason String The closure reason of the Case.
GoogleSecOps.Case.closureDetails.comment String The closure comment of the Case.
GoogleSecOps.Case.closureDetails.rootCause String The root cause provided at closure.
GoogleSecOps.Case.closureDetails.caseClosedAction String The action taken when the Case was closed.

Command example

!gcb-case-get case_id=1001

Context Example

{
    "GoogleSecOps": {
        "Case": {
            "name": "projects/chronicle-mock-proj/locations/us/instances/00000000-0000-0000-0000-000000000001/cases/1001",
            "caseId": "1001",
            "displayName": "Test Case",
            "lastModifyingUserId": "00000000-0000-0000-0000-000000000002",
            "createTime": "1778778979232",
            "updateTime": "1779426987796",
            "alertCount": 15,
            "stage": "Triage",
            "priority": "PRIORITY_MEDIUM",
            "important": false,
            "incident": false,
            "assignee": "@Tier1",
            "type": "EXTERNAL",
            "overflowCase": false,
            "environment": "Default Environment",
            "status": "OPENED",
            "workflowStatus": "PENDING_FOR_USER",
            "sla": {
                "expirationTime": "1780832620238",
                "criticalExpirationTime": "1780580620238",
                "expirationStatus": "OPEN_SLA"
            },
            "alertsSla": {
                "expirationTime": "1782774000000",
                "expirationStatus": "OPEN_SLA"
            },
            "source": "Server",
            "involvedSuspiciousEntity": false,
            "tags": [
                {"displayName": "demo 1", "priority": 0},
                {"displayName": "demo 2", "priority": 1}
            ],
            "products": [
                {"displayName": "Test Case", "alert": "alert 1"},
                {"displayName": "Test Case", "alert": "alert 2"}
            ],
            "tasks": [
                {
                    "id": "3",
                    "createTime": "1779447705049",
                    "updateTime": "1779447705049",
                    "content": "Testing",
                    "title": "XSOAR testing",
                    "author": "00000000-0000-0000-0000-000000000001",
                    "lastAuthor": "00000000-0000-0000-0000-000000000002",
                    "assignee": "00000000-0000-0000-0000-000000000001",
                    "status": "PENDING",
                    "favorite": false,
                    "caseId": 1001
                }
            ],
            "closureDetails": {
                "reason": "NOT_MALICIOUS",
                "rootCause": "False positive from detection rule",
                "caseClosedAction": "MANUALLY",
                "comment": "Reviewed and confirmed benign activity.\n Case closed by Siemplify API. \nAll attached playbooks and playbook blocks have been terminated.\nAll Alerts were closed."
            }
        }
    }
}

Human Readable Output

Case Information

Case ID Display Name Priority Status Stage Assignee Alert Count Type Environment Source Workflow Status SLA Alerts SLA Tags Create Time Update Time Incident Important Involved Suspicious Entity Overflow Case Last Modifying User ID Products Tasks Closure Details
1001 Test Case MEDIUM OPENED Triage @Tier1 15 EXTERNAL Default Environment Server PENDING_FOR_USER Status: OPEN_SLA
Expiration Time: 2026-06-07 11:43:40 UTC
Critical Expiration Time: 2026-06-04 13:43:40 UTC		 Status: OPEN_SLA
Expiration Time: 2026-06-29 23:00:00 UTC		 - displayName: demo 1
priority: 0
- displayName: demo 2
priority: 1		 2026-05-14 17:16:19 UTC 2026-05-22 05:16:27 UTC False False False False 00000000-0000-0000-0000-000000000002 - displayName: Test Case
alert: alert 1
- displayName: Test Case
alert: alert 2		 - id: 3
createTime: 1779447705049
updateTime: 1779447705049
content: Testing
title: XSOAR testing
author: 00000000-0000-0000-0000-000000000001
lastAuthor: 00000000-0000-0000-0000-000000000002
assignee: 00000000-0000-0000-0000-000000000001
status: PENDING
favorite: False
caseId: 1001		 reason: NOT_MALICIOUS
rootCause: False positive from detection rule
caseClosedAction: MANUALLY
comment: Reviewed and confirmed benign activity.
Case closed by Siemplify API.
All attached playbooks and playbook blocks have been terminated.
All Alerts were closed.

gcb-case-update

Update the properties of a case.

Base Command

gcb-case-update

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required
display_name Specify the new title for the case.

Note: If the value is greater than 200 characters, it will be truncated to 200 characters.		 Optional
description Specify the new description for the case.

Note: If the value is greater than 1000 characters, it will be truncated to 1000 characters.		 Optional
important Specify whether to mark the case as important. Possible values are: True, False. Optional
incident Specify whether to mark the case as an incident. Possible values are: True, False. Optional

Context Output

Path Type Description
GoogleSecOps.Case.name String The unique resource name of the Case.
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.displayName String The title of the Case.
GoogleSecOps.Case.creatorUserId String The ID of the user who created the Case.
GoogleSecOps.Case.lastModifyingUserId String The ID of the user who last modified the Case.
GoogleSecOps.Case.createTime String The creation time of the Case (unix epoch milliseconds).
GoogleSecOps.Case.updateTime String The last update time of the Case (unix epoch milliseconds).
GoogleSecOps.Case.alertCount Number The number of alerts linked to the Case.
GoogleSecOps.Case.stage String The current workflow stage of the Case.
GoogleSecOps.Case.priority String The priority of the Case.
GoogleSecOps.Case.assignee String The assigned user or SOC role of the Case.
GoogleSecOps.Case.description String The description of the Case.
GoogleSecOps.Case.type String The type of the Case.
GoogleSecOps.Case.environment String The logical environment of the Case.
GoogleSecOps.Case.status String The status of the Case.
GoogleSecOps.Case.score Number The attack exposure score of the Case.
GoogleSecOps.Case.workflowStatus String The playbook or workflow status of the Case.
GoogleSecOps.Case.source String The source that created the Case.
GoogleSecOps.Case.important Boolean Whether the Case is marked as important.
GoogleSecOps.Case.incident Boolean Whether the Case is marked as an incident.
GoogleSecOps.Case.overflowCase Boolean Whether the Case is an overflow case due to large data volume.
GoogleSecOps.Case.involvedSuspiciousEntity Boolean Whether a suspicious entity is involved in the Case.
GoogleSecOps.Case.sla.expirationTime String The SLA expiration time of the Case (unix ms).
GoogleSecOps.Case.sla.criticalExpirationTime String The SLA critical expiration time of the Case (unix ms).
GoogleSecOps.Case.sla.expirationStatus String The SLA expiration status of the Case.
GoogleSecOps.Case.sla.remainingTimeSinceLastPause Number The remaining time since the last SLA pause of the Case.
GoogleSecOps.Case.alertsSla.expirationTime String The aggregated alerts SLA expiration time of the Case (unix ms).
GoogleSecOps.Case.alertsSla.criticalExpirationTime String The aggregated alerts SLA critical expiration time of the Case (unix ms).
GoogleSecOps.Case.alertsSla.expirationStatus String The aggregated alerts SLA expiration status.
GoogleSecOps.Case.alertsSla.remainingTimeSinceLastPause Number The remaining time since the last alerts SLA pause of the Case.
GoogleSecOps.Case.tags.displayName String The display name of the tag.
GoogleSecOps.Case.tags.priority Number The priority order of the tag.
GoogleSecOps.Case.products.displayName String The display name of the product.
GoogleSecOps.Case.products.alert String The resource name of the alert associated with the product.
GoogleSecOps.Case.tasks.id String The ID of the task.
GoogleSecOps.Case.tasks.title String The title of the task.
GoogleSecOps.Case.tasks.content String The content/description of the task.
GoogleSecOps.Case.tasks.status String The status of the task.
GoogleSecOps.Case.tasks.assignee String The assignee of the task.
GoogleSecOps.Case.tasks.author String The author who created the task.
GoogleSecOps.Case.tasks.lastAuthor String The last user who modified the task.
GoogleSecOps.Case.tasks.createTime String The creation time of the task (unix epoch milliseconds).
GoogleSecOps.Case.tasks.updateTime String The last update time of the task (unix epoch milliseconds).
GoogleSecOps.Case.tasks.caseId Number The ID of the Case the task belongs to.
GoogleSecOps.Case.tasks.favorite Boolean Whether the task is marked as a favorite.
GoogleSecOps.Case.closureDetails.reason String The closure reason of the Case.
GoogleSecOps.Case.closureDetails.comment String The closure comment of the Case.
GoogleSecOps.Case.closureDetails.rootCause String The root cause provided at closure.
GoogleSecOps.Case.closureDetails.caseClosedAction String The action taken when the Case was closed.

Command example

!gcb-case-update case_id=1001 display_name="XSOAR 1 Testing" important=True

Context Example

{
    "GoogleSecOps": {
        "Case": {
            "caseId": "1001",
            "lastModifyingUserId": "Siemplify automation",
            "createTime": "1780569465745",
            "updateTime": "1780912611281",
            "displayName": "XSOAR 1 Testing",
            "alertCount": 1,
            "stage": "Triage",
            "priority": "PRIORITY_LOW",
            "important": true,
            "incident": false,
            "assignee": "00000000-0000-0000-0000-000000000001",
            "type": "EXTERNAL",
            "overflowCase": false,
            "environment": "XSOAR",
            "status": "OPENED",
            "workflowStatus": "NONE",
            "sla": {
                "expirationStatus": "NO_SLA"
            },
            "alertsSla": {
                "expirationStatus": "NO_SLA"
            },
            "source": "User",
            "involvedSuspiciousEntity": false
        }
    }
}

Human Readable Output

Updated Case Information

Case ID Display Name Priority Status Stage Assignee Alert Count Type Environment Source Workflow Status SLA Alerts SLA Create Time Update Time Incident Important Involved Suspicious Entity Overflow Case Last Modifying User ID
1001 XSOAR 1 Testing LOW OPENED Triage 00000000-0000-0000-0000-000000000001 1 EXTERNAL XSOAR User NONE Status: NO_SLA Status: NO_SLA 2026-06-04 10:37:45 UTC 2026-06-08 09:56:51 UTC False True False False Siemplify automation

gcb-case-tag-add

Add the specified tags to the cases.

Base Command

gcb-case-tag-add

Input

Argument Name Description Required
case_ids Specify the IDs of the case to add tags. Supports comma-separated values.

Note: Use gcb-case-list to retrieve case ID.		 Required
tags Specify the tags to add to the cases. Supports comma-separated values. Required

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.recentlyAddedTags String The list of recently added tags.

Command example

!gcb-case-tag-add case_ids=1001,1002 tags=malware,phishing

Context Example

{
    "GoogleSecOps": {
        "Case": [
            {
                "caseId": "1001",
                "recentlyAddedTags": ["malware", "phishing"]
            },
            {
                "caseId": "1002",
                "recentlyAddedTags": ["malware", "phishing"]
            }
        ]
    }
}

Human Readable Output

Tags malware, phishing successfully added to cases 1001, 1002.

gcb-case-tag-remove

Remove the specified tag from a case.

Base Command

gcb-case-tag-remove

Input

Argument Name Description Required
case_id Specify the ID of the case to remove the tag.

Note: Use gcb-case-list to retrieve case ID.		 Required
tag Specify the tag to remove from the case. Required

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.recentlyRemovedTag String The tag that was recently removed from the case.

Command example

!gcb-case-tag-remove case_id=1001 tag=malware

Context Example

{
    "GoogleSecOps": {
        "Case": {
            "caseId": "1001",
            "recentlyRemovedTag": "malware"
        }
    }
}

Human Readable Output

Tag malware successfully removed from case 1001.

gcb-case-priority-change

Change the priority of the specified cases.

Base Command

gcb-case-priority-change

Input

Argument Name Description Required
case_ids Specify the IDs of the case to change priority. Supports comma-separated values.

Note: Use gcb-case-list to retrieve case ID.		 Required
priority Specify the new priority level for the cases. Possible values are: UNSPECIFIED, INFO, LOW, MEDIUM, HIGH, CRITICAL. Required

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.priority String The updated priority of the Case.

Command example

!gcb-case-priority-change case_ids=1001,1002 priority=CRITICAL

Context Example

{
    "GoogleSecOps": {
        "Case": [
            {
                "caseId": "1001",
                "priority": "CRITICAL"
            },
            {
                "caseId": "1002",
                "priority": "CRITICAL"
            }
        ]
    }
}

Human Readable Output

Priority of cases 1001, 1002 successfully changed to CRITICAL.

gcb-case-stage-definition-list

Retrieve the list of case stage definitions configured in the instance.

Base Command

gcb-case-stage-definition-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
GoogleSecOps.CaseStageDefinition Unknown The list of the case stage definitions.

Command example


#### Context Example

```json
{
    "GoogleSecOps": {
        "CaseStageDefinition": [
            "Triage",
            "Assessment",
            "Investigation"
        ]
    }
}

Human Readable Output

Case Stage Definitions: Triage, Assessment, Investigation

gcb-case-stage-change

Change the workflow stage of the specified cases.

Base Command

gcb-case-stage-change

Input

Argument Name Description Required
case_ids Specify the IDs of the case to change stage. Supports comma-separated values.

Note: Use gcb-case-list to retrieve case ID.		 Required
stage Specify the new workflow stage name.

Note: Use gcb-case-stage-definition-list to retrieve case stage definition list. Possible values are: Triage, Incident, Investigation.		 Required

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.stage String The updated workflow stage of the Case.

Command example

!gcb-case-stage-change case_ids=1001,1002 stage=Investigation

Context Example

{
    "GoogleSecOps": {
        "Case": [
            {
                "caseId": "1001",
                "stage": "Investigation"
            },
            {
                "caseId": "1002",
                "stage": "Investigation"
            }
        ]
    }
}

Human Readable Output

Stage of cases 1001, 1002 successfully changed to Investigation.

gcb-case-reopen

Reopen the specified cases.

Base Command

gcb-case-reopen

Input

Argument Name Description Required
case_ids Specify the IDs of the case to reopen. Supports comma-separated values.

Note: Use gcb-case-list to retrieve case ID.		 Required
reopen_comment Specify a comment explaining why the cases are being reopened. Required

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.status String The status of the Case after reopening.

Command example

!gcb-case-reopen case_ids=1001,1002 reopen_comment="Reopening due to new evidence of malicious activity."

Context Example

{
    "GoogleSecOps": {
        "Case": [
            {
                "caseId": "1001",
                "status": "OPENED"
            },
            {
                "caseId": "1002",
                "status": "OPENED"
            }
        ]
    }
}

Human Readable Output

Cases 1001, 1002 successfully reopened.

gcb-case-close-definition-list

Retrieve the list of case close definitions configured in the instance.

Base Command

gcb-case-close-definition-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
GoogleSecOps.CaseCloseDefinition.name String The unique resource name of the Case close definition.
GoogleSecOps.CaseCloseDefinition.closeReason String The close reason of the Case close definition.
GoogleSecOps.CaseCloseDefinition.rootCause String The root cause of the Case close definition.

Command example


#### Context Example

```json
{
    "GoogleSecOps": {
        "CaseCloseDefinition": [
            {
                "name": "projects/my-project/locations/us/instances/my-instance/caseCloseDefinitions/1",
                "closeReason": "MAINTENANCE",
                "rootCause": "Rule under construction"
            },
            {
                "name": "projects/my-project/locations/us/instances/my-instance/caseCloseDefinitions/2",
                "closeReason": "INCONCLUSIVE",
                "rootCause": "No clear conclusion"
            },
            {
                "name": "projects/my-project/locations/us/instances/my-instance/caseCloseDefinitions/3",
                "closeReason": "NOT_MALICIOUS",
                "rootCause": "Similar case is already under investigation"
            },
            {
                "name": "projects/my-project/locations/us/instances/my-instance/caseCloseDefinitions/4",
                "closeReason": "MALICIOUS",
                "rootCause": "Irrelevant TCP/UDP port"
            }
        ]
    }
}

Human Readable Output

Close Reason Root Cause
MAINTENANCE Rule under construction
INCONCLUSIVE No clear conclusion
NOT_MALICIOUS Similar case is already under investigation
MALICIOUS Irrelevant TCP/UDP port

gcb-case-close

Close the specified cases.

Base Command

gcb-case-close

Input

Argument Name Description Required
case_ids Specify the IDs of the case to close. Supports comma-separated values.

Note: Use gcb-case-list to retrieve case ID.		 Required
close_reason Specify the reason for closing the cases. Possible values are: MALICIOUS, NOT_MALICIOUS, MAINTENANCE, INCONCLUSIVE, UNKNOWN, CLOSE_REASON_UNSPECIFIED. Required
root_cause Specify the root cause description for the closure. Required
close_comment Specify a comment to add when closing the cases. Optional

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.status String The status of the Case after closure.
GoogleSecOps.Case.closureDetails.reason String The closure reason of the Case.
GoogleSecOps.Case.closureDetails.comment String The closure comment of the Case.
GoogleSecOps.Case.closureDetails.rootCause String The root cause provided at closure.

Command example

!gcb-case-close case_ids=1001,1002 close_reason=NOT_MALICIOUS root_cause="False positive from detection rule" close_comment="Confirmed not malicious"

Context Example

{
    "GoogleSecOps": {
        "Case": [
            {
                "caseId": "1001",
                "status": "CLOSED",
                "closureDetails": {
                    "reason": "NOT_MALICIOUS",
                    "rootCause": "False positive",
                    "comment": "Confirmed not malicious"
                }
            },
            {
                "caseId": "1002",
                "status": "CLOSED",
                "closureDetails": {
                    "reason": "NOT_MALICIOUS",
                    "rootCause": "False positive",
                    "comment": "Confirmed not malicious"
                }
            }
        ]
    }
}

Human Readable Output

Cases 1001, 1002 successfully closed with reason NOT_MALICIOUS.

gcb-case-assign

Assign the specified cases to a specific analyst or SOC role.

Base Command

gcb-case-assign

Input

Argument Name Description Required
case_ids Specify the IDs of the case to assign. Supports comma-separated values.

Note: Use gcb-case-list to retrieve case ID.		 Required
assignee Specify the user email address or a SOC role.

For SOC roles, add the @ prefix (for example, @Tier1).		 Required

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.assignee String The resolved user ID or SOC role assigned to the Case after the operation.

Command example

!gcb-case-assign case_ids=1001,1002 assignee=@SocRole

Context Example

{
    "GoogleSecOps": {
        "Case": [
            {
                "caseId": "1001",
                "assignee": "@SocRole"
            },
            {
                "caseId": "1002",
                "assignee": "@SocRole"
            }
        ]
    }
}

Human Readable Output

Cases 1001, 1002 successfully assigned to @SocRole.

gcb-case-comment-list

Retrieve the list of comments associated with the specified case.

Base Command

gcb-case-comment-list

Input

Argument Name Description Required
case_id Specify the ID of the case to retrieve comments.

Note: Use gcb-case-list to retrieve case ID.		 Required
page_size Specify the maximum number of comments to return.

Note: Maximum value is 1000. Default is 50.		 Optional
page_token Specify the page token for pagination.

Note: Use the next_page_token from a previous gcb-case-comment-list response.		 Optional
sort_by Specify the field to sort results by. Possible values are: createTime, updateTime, user, comment, deletionInvoker, favorite, alert, deleted. Default is createTime. Optional
sort_order Specify the sort direction for the results. Possible values are: Asc, Desc. Default is Desc. Optional

Context Output

Path Type Description
GoogleSecOps.CaseComment.name String The unique resource name of the Case comment.
GoogleSecOps.CaseComment.commentId String The ID of the Case comment.
GoogleSecOps.CaseComment.createTime String The creation time of the Case comment (unix epoch milliseconds).
GoogleSecOps.CaseComment.updateTime String The last update time of the Case comment (unix epoch milliseconds).
GoogleSecOps.CaseComment.user String User owner of the comment.
GoogleSecOps.CaseComment.comment String The text of the Case comment.
GoogleSecOps.CaseComment.userOwnerFullName String The user who created the comment.
GoogleSecOps.CaseComment.lastEditorFullName String The user who last edited the comment.
GoogleSecOps.CaseComment.deletedByUser String The user who deleted the comment.
GoogleSecOps.CaseComment.alertIdentifier String The alert associated with the comment.
GoogleSecOps.CaseComment.isFavorite Boolean Whether the comment is marked as a favorite.
GoogleSecOps.CaseComment.isDeleted Boolean Indicates if the comment has been softly deleted.
GoogleSecOps.CaseComment.case String The case associated with the comment.
GoogleSecOps.PageToken.command String The command name associated with the pagination token.
GoogleSecOps.PageToken.nextPageToken String Token to fetch the next page of case comments.
GoogleSecOps.PageToken.totalSize Number The total number of case comments available.

Command example

!gcb-case-comment-list case_id=1001

Context Example

{
    "GoogleSecOps": {
        "CaseComment": [
            {
                "name": "projects/chronicle-mock-proj/locations/us/instances/mock-inst-uuid/cases/1001/caseComments/2001",
                "commentId": "2001",
                "createTime": "1780466772061",
                "updateTime": "1780466772061",
                "comment": "Initial assessment complete. Escalating to senior analyst.",
                "isFavorite": true,
                "alertIdentifier": "alert-mock-security-001",
                "isDeleted": false,
                "case": "1001"
            },
            {
                "name": "projects/chronicle-mock-proj/locations/us/instances/mock-inst-uuid/cases/1001/caseComments/2002",
                "commentId": "2002",
                "createTime": "1780465892736",
                "updateTime": "1780465892736",
                "user": "user-uuid-mock-12345",
                "comment": "Threat actor identified. Initiating containment measures.",
                "userOwnerFullName": "Bob Wilson",
                "lastEditorFullName": "Bob Wilson",
                "isFavorite": false,
                "isDeleted": false,
                "deletedByUser": "user-uuid-mock-12345",
                "case": "1001"
            }
        ],
        "PageToken": {
            "command": "gcb-case-comment-list",
            "nextPageToken": "mock-pagination-token",
            "totalSize": 4
        }
    }
}

Human Readable Output

Case Comments

Author Comment Create Time
Automation Initial assessment complete. Escalating to senior analyst. 2026-06-03 06:06:12 UTC
Bob Wilson Threat actor identified. Initiating containment measures. 2026-06-03 05:51:32 UTC

Maximum number of comments specified in page_size has been returned. To fetch the next set of comments, execute the command with the page token as mock-pagination-token.

gcb-case-comment-create

Add a comment to the specified case.

Base Command

gcb-case-comment-create

Input

Argument Name Description Required
case_id Specify the ID of the case to add the comment.

Note: Use gcb-case-list to retrieve case ID.		 Required
comment Specify the comment text to add to the case. Required

Context Output

Path Type Description
GoogleSecOps.CaseComment.name String The unique resource name of the Case comment.
GoogleSecOps.CaseComment.commentId String The ID of the Case comment.
GoogleSecOps.CaseComment.createTime String The creation time of the Case comment (unix epoch milliseconds).
GoogleSecOps.CaseComment.updateTime String The last update time of the Case comment (unix epoch milliseconds).
GoogleSecOps.CaseComment.user String User owner of the comment.
GoogleSecOps.CaseComment.comment String The text of the Case comment.
GoogleSecOps.CaseComment.userOwnerFullName String The user who created the comment.
GoogleSecOps.CaseComment.lastEditorFullName String The user who last edited the comment.
GoogleSecOps.CaseComment.deletedByUser String The user who deleted the comment.
GoogleSecOps.CaseComment.alertIdentifier String The alert associated with the comment.
GoogleSecOps.CaseComment.isFavorite Boolean Whether the comment is marked as a favorite.
GoogleSecOps.CaseComment.isDeleted Boolean Indicates if the comment has been softly deleted.
GoogleSecOps.CaseComment.case String The case associated with the comment.

Command example

!gcb-case-comment-create case_id=1001 comment="Investigated the outbound traffic. Confirmed malicious C2 communication."

Context Example

{
    "GoogleSecOps": {
        "CaseComment": {
            "name": "projects/chronicle-mock-proj/locations/us/instances/mock-inst-uuid/cases/1001/caseComments/comment-001",
            "commentId": "comment-001",
            "createTime": "1780642722226",
            "updateTime": "1780642722226",
            "comment": "Investigated the outbound traffic. Confirmed malicious C2 communication.",
            "isFavorite": false,
            "isDeleted": false,
            "case": "1001"
        }
    }
}

Human Readable Output

Successfully added the following comment to case “1001” at 2026-06-05 06:58:42 UTC:

Investigated the outbound traffic. Confirmed malicious C2 communication.

gcb-case-sla-pause

Pause the SLA timer for the specified case.

Base Command

gcb-case-sla-pause

Input

Argument Name Description Required
case_id Specify the ID of the case to pause the SLA timer.

Note: Use gcb-case-list to retrieve case ID.		 Required
message Specify the reason for pausing the SLA timer. Optional

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.slaStatus String The SLA status of the Case after the operation.

Command example

!gcb-case-sla-pause case_id=1001 message="Pausing SLA pending additional investigation."

Context Example

{
    "GoogleSecOps": {
        "Case": {
            "caseId": "1001",
            "slaStatus": "PAUSED"
        }
    }
}

Human Readable Output

SLA timer for case 1001 successfully paused.

gcb-case-sla-resume

Resume the SLA timer for the specified case.

Base Command

gcb-case-sla-resume

Input

Argument Name Description Required
case_id Specify the ID of the case to resume the SLA timer.

Note: Use gcb-case-list to retrieve case ID.		 Required

Context Output

Path Type Description
GoogleSecOps.Case.caseId String The ID of the Case.
GoogleSecOps.Case.slaStatus String The SLA status of the Case after the operation.

Command example

!gcb-case-sla-resume case_id=1001

Context Example

{
    "GoogleSecOps": {
        "Case": {
            "caseId": "1001",
            "slaStatus": "SLA_EXPIRATION_STATUS_UNSPECIFIED"
        }
    }
}

Human Readable Output

SLA timer for case 1001 successfully resumed.

gcb-case-alert-list

Retrieve the list of alerts associated with the specified case.

Base Command

gcb-case-alert-list

Input

Argument Name Description Required
case_id Specify the ID of the case to list alerts.

Note: Use gcb-case-list to retrieve case ID.		 Required
display_name Filter alerts by display name. Supports comma-separated values. Optional
priority Filter alerts by priority. Supports comma-separated values. Possible values are: LEGACY_CASE_PRIORITY_UNSPECIFIED, UNCHANGED, INFORMATIVE, LOW, MEDIUM, HIGH, CRITICAL. Optional
status Filter alerts by status. Supports comma-separated values. Possible values are: OPEN, CLOSE, ALERT_STATUS_UNSPECIFIED. Optional
product Filter alerts by product name. Supports comma-separated values. Optional
vendor Filter alerts by vendor name. Supports comma-separated values. Optional
tag Filter alerts by tag name. Supports comma-separated values. Optional
environment Filter alerts by environment name. Supports comma-separated values. Optional
source_system_name Filter alerts by the alerting system that raised the alert. Supports comma-separated values. Optional
manual Filter alerts by whether they were created manually. Possible values are: True, False. Optional
create_start_time Filter alerts created on or after this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
create_end_time Filter alerts created on or before this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
update_start_time Filter alerts updated on or after this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
update_end_time Filter alerts updated on or before this time.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 May 2026, 2026-05-17T14:05:44Z.		 Optional
advanced_filter Specify a raw AIP-160 filter string to query alerts with advanced conditions. When provided, this filter is used as-is and all other filter arguments are ignored.

Note: Supported filter fields: displayName, product, vendor, environment, sourceSystemName, priority, status, createTime, updateTime.

Example: (priority=’HIGH’ OR status=’OPEN’) AND product=’DLP’.		 Optional
filter_logic Specify the logical operator to combine filter conditions. Possible values are: AND, OR. Default is AND. Optional
page_size Specify the maximum number of alerts to return.

Note: Maximum value is 1000. Default is 50.		 Optional
page_token Specify the page token for pagination.

Note: Use the next_page_token from a previous gcb-case-alert-list response.		 Optional
sort_by Specify the field to sort results by. Possible values are: displayName, caseId, identifier, sourceGroupingIdentifier, product, vendor, environment, ticketId, sourceSystemName, priority, status, startTime, endTime, createTime. Default is createTime. Optional
sort_order Specify the sort direction for the results. Possible values are: Asc, Desc. Default is Desc. Optional

Context Output

Path Type Description
GoogleSecOps.CaseAlert.name String The unique resource name of the Case Alert.
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert extracted from the resource name.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.identifier String The legacy identifier (alert title + GUID) of the Case Alert.
GoogleSecOps.CaseAlert.sourceGroupingIdentifier String The source grouping identifier used to group related Case Alerts.
GoogleSecOps.CaseAlert.alertGroupIdentifier String The alert group identifier of the Case Alert.
GoogleSecOps.CaseAlert.displayName String The display name of the Case Alert.
GoogleSecOps.CaseAlert.product String The product associated with the Case Alert.
GoogleSecOps.CaseAlert.vendor String The vendor associated with the Case Alert.
GoogleSecOps.CaseAlert.environment String The environment of the Case Alert.
GoogleSecOps.CaseAlert.sourceSystemName String The alerting system that raised the Case Alert.
GoogleSecOps.CaseAlert.sourceIdentifier String The source identifier (e.g. connector ID) of the Case Alert.
GoogleSecOps.CaseAlert.ruleGenerator String The third-party rule that triggered the Case Alert.
GoogleSecOps.CaseAlert.siemAlertId String The SIEM alert identifier of the Case Alert.
GoogleSecOps.CaseAlert.sourceUrl String The source URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceRuleUrl String The source rule URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceSystemUrl String The source system URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceRuleIdentifier String The source rule identifier of the Case Alert.
GoogleSecOps.CaseAlert.ticketId String The ticket ID linked to the Case Alert in the integrated ticketing system.
GoogleSecOps.CaseAlert.additionalProperties String The additional connector data of the Case Alert as a JSON string.
GoogleSecOps.CaseAlert.priority String The priority of the Case Alert.
GoogleSecOps.CaseAlert.status String The status of the Case Alert.
GoogleSecOps.CaseAlert.manual Boolean Whether the Case Alert was created manually.
GoogleSecOps.CaseAlert.nestingDepth Number The nesting depth level of the Case Alert.
GoogleSecOps.CaseAlert.playbookStatus String The playbook or workflow status of the Case Alert.
GoogleSecOps.CaseAlert.attachedPlaybookName String The name of the playbook attached to the Case Alert.
GoogleSecOps.CaseAlert.eventCount Number The number of events that triggered the Case Alert.
GoogleSecOps.CaseAlert.playbookRunCount Number The number of times the first playbook was run for the Case Alert.
GoogleSecOps.CaseAlert.createTime String The creation time of the Case Alert (unix epoch milliseconds).
GoogleSecOps.CaseAlert.updateTime String The last update time of the Case Alert (unix epoch milliseconds).
GoogleSecOps.CaseAlert.startTime String The time the alert was created on the third-party system.
GoogleSecOps.CaseAlert.endTime String The time the alert was closed on the third-party system.
GoogleSecOps.CaseAlert.sla.expirationStatus String The SLA expiration status of the Case Alert.
GoogleSecOps.CaseAlert.sla.expirationTime String The SLA expiration time of the Case Alert.
GoogleSecOps.CaseAlert.sla.criticalExpirationTime String The SLA critical expiration time of the Case Alert.
GoogleSecOps.CaseAlert.sla.remainingTimeSinceLastPause Number The remaining time since the last SLA pause of the Case Alert.
GoogleSecOps.CaseAlert.tags.tag String The tag value associated with the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.reason String The closure reason of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.comment String The closure comment of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.rootCause String The root cause provided at closure of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.closingTimeMs String The closure time of the Case Alert in Unix milliseconds.
GoogleSecOps.CaseAlert.involvedRelations.identifier String The identifier of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.alertIdentifier String The identifier of the alert the Involved Relation belongs to.
GoogleSecOps.CaseAlert.involvedRelations.caseId Number The Case ID the Involved Relation belongs to.
GoogleSecOps.CaseAlert.involvedRelations.relationType String The type of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.deviceProduct String The product associated with the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.deviceVendor String The vendor associated with the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.categoryOutcome String The category outcome of the Involved Relation (e.g. Blocked, Allowed).
GoogleSecOps.CaseAlert.involvedRelations.destinationPort String The destination port of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.eventClassId String The event display name of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.startTime Date The start time of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.endTime Date The end time of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.additionalProperties String The additional data of the Involved Relation as a JSON string.
GoogleSecOps.CaseAlert.involvedRelations.from.identifier String The identifier of the source entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.from.type String The type of the source entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.to.identifier String The identifier of the destination entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.to.type String The type of the destination entity of the Involved Relation.
GoogleSecOps.PageToken.command String The command name associated with the pagination token.
GoogleSecOps.PageToken.nextPageToken String The token to retrieve the next page of Case Alerts.
GoogleSecOps.PageToken.totalSize Number The total number of Case Alerts matching the query.

Command example

!gcb-case-alert-list case_id=1001 priority=HIGH status=OPEN sort_by=priority sort_order=Asc page_size=10

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": [
            {
                "name": "projects/chronicle-mock-proj/locations/us/instances/00000000-0000-0000-0000-000000000001/cases/1001/caseAlerts/1000001",
                "alertId": "1000001",
                "caseId": 1001,
                "identifier": "TEST ALERT_00000000-0000-0000-0000-000000000010",
                "displayName": "TEST ALERT",
                "product": "Test Product",
                "vendor": "Test Vendor",
                "environment": "Default Environment",
                "sourceSystemName": "Test Source System",
                "ruleGenerator": "Test-Alert-Rule-01",
                "sourceGroupingIdentifier": "0.0.0.1",
                "sourceIdentifier": "Test Source Identifier_00000000-0000-0000-0000-000000000011",
                "ticketId": "0.0.0.1_2026-05-10 08:00:00",
                "additionalProperties": "{\"Name\":\"TEST ALERT\",\"Type\":\"ALERT\"}",
                "priority": "HIGH",
                "status": "OPEN",
                "createTime": "1778778979232",
                "updateTime": "1779426987796",
                "startTime": "1778778979232",
                "endTime": "1779426987796",
                "playbookStatus": "COMPLETED",
                "attachedPlaybookName": "Test Playbook",
                "alertGroupIdentifier": "TEST ALERT_00000000-0000-0000-0000-000000000010",
                "eventCount": 5,
                "playbookRunCount": 1,
                "sla": {
                    "expirationTime": "1780832620238",
                    "expirationStatus": "OPEN_SLA"
                },
                "tags": [
                    {
                        "tag": "demo_1"
                    }
                ],
                "involvedRelations": [
                    {
                        "identifier": "00000000-0000-0000-0000-000000000020",
                        "alertIdentifier": "TEST ALERT_00000000-0000-0000-0000-000000000010",
                        "caseId": 1001,
                        "relationType": "ALERT",
                        "deviceProduct": "Test Product",
                        "deviceVendor": "Test Vendor",
                        "categoryOutcome": "Blocked",
                        "destinationPort": "443",
                        "eventClassId": "Test Event Class",
                        "from": {
                            "identifier": "0.0.0.1",
                            "type": "ADDRESS"
                        },
                        "to": {
                            "identifier": "test-host-01",
                            "type": "HOSTNAME"
                        }
                    }
                ]
            },
            {
                "name": "projects/chronicle-mock-proj/locations/us/instances/00000000-0000-0000-0000-000000000001/cases/1001/caseAlerts/1000002",
                "alertId": "1000002",
                "caseId": 1001,
                "identifier": "TEST ALERT 2_00000000-0000-0000-0000-000000000030",
                "displayName": "TEST ALERT 2",
                "product": "Test Product 2",
                "vendor": "Test Vendor 2",
                "environment": "Default Environment",
                "sourceSystemName": "Test Source System 2",
                "ruleGenerator": "Test-Alert-Rule-02",
                "sourceGroupingIdentifier": "0.0.0.1",
                "ticketId": "0.0.0.2_2026-05-10 07:00:00",
                "additionalProperties": "{\"Name\":\"TEST ALERT 2\",\"Type\":\"ALERT\"}",
                "priority": "MEDIUM",
                "status": "OPEN",
                "createTime": "1778778979000",
                "updateTime": "1779426987000",
                "startTime": "1778778979000",
                "endTime": "1779426987000",
                "playbookStatus": "PENDING_FOR_USER",
                "attachedPlaybookName": "Test Playbook 2",
                "alertGroupIdentifier": "TEST ALERT 2_00000000-0000-0000-0000-000000000030",
                "eventCount": 2,
                "playbookRunCount": 0,
                "sla": {
                    "expirationTime": "1779426987000",
                    "expirationStatus": "OPEN_SLA"
                }
            }
        ],
        "PageToken": {
            "command": "gcb-case-alert-list",
            "nextPageToken": "test-next-page-token",
            "totalSize": 10
        }
    }
}

Human Readable Output

Case Alerts List

Alert ID Alert Name Create Time Priority Status Events Count Alert SLA Playbook Attached Name Playbook Attached Status
1000001 TEST ALERT 2026-05-14 17:16:19 UTC HIGH OPEN 5 Status: OPEN_SLA
Expiration Time: 2026-06-07 11:43:40 UTC		 Test Playbook COMPLETED
1000002 TEST ALERT 2 2026-05-14 17:16:19 UTC MEDIUM OPEN 2 Status: OPEN_SLA
Expiration Time: 2026-05-22 05:16:27 UTC		 Test Playbook 2 PENDING_FOR_USER

Maximum number of alerts specified in page_size has been returned. To fetch the next set of alerts, execute the command with the page token as test-next-page-token.

gcb-case-alert-get

Retrieve detailed information about a specific case alert by its ID.

Base Command

gcb-case-alert-get

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to retrieve.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required

Context Output

Path Type Description
GoogleSecOps.CaseAlert.name String The unique resource name of the Case Alert.
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert extracted from the resource name.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.identifier String The legacy identifier (alert title + GUID) of the Case Alert.
GoogleSecOps.CaseAlert.sourceGroupingIdentifier String The source grouping identifier used to group related Case Alerts.
GoogleSecOps.CaseAlert.alertGroupIdentifier String The alert group identifier of the Case Alert.
GoogleSecOps.CaseAlert.displayName String The display name of the Case Alert.
GoogleSecOps.CaseAlert.product String The product associated with the Case Alert.
GoogleSecOps.CaseAlert.vendor String The vendor associated with the Case Alert.
GoogleSecOps.CaseAlert.environment String The environment of the Case Alert.
GoogleSecOps.CaseAlert.sourceSystemName String The alerting system that raised the Case Alert.
GoogleSecOps.CaseAlert.sourceIdentifier String The source identifier (e.g. connector ID) of the Case Alert.
GoogleSecOps.CaseAlert.ruleGenerator String The third-party rule that triggered the Case Alert.
GoogleSecOps.CaseAlert.siemAlertId String The SIEM alert identifier of the Case Alert.
GoogleSecOps.CaseAlert.sourceUrl String The source URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceRuleUrl String The source rule URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceSystemUrl String The source system URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceRuleIdentifier String The source rule identifier of the Case Alert.
GoogleSecOps.CaseAlert.ticketId String The ticket ID linked to the Case Alert in the integrated ticketing system.
GoogleSecOps.CaseAlert.additionalProperties String The additional connector data of the Case Alert as a JSON string.
GoogleSecOps.CaseAlert.priority String The priority of the Case Alert.
GoogleSecOps.CaseAlert.status String The status of the Case Alert.
GoogleSecOps.CaseAlert.manual Boolean Whether the Case Alert was created manually.
GoogleSecOps.CaseAlert.nestingDepth Number The nesting depth level of the Case Alert.
GoogleSecOps.CaseAlert.playbookStatus String The playbook or workflow status of the Case Alert.
GoogleSecOps.CaseAlert.attachedPlaybookName String The name of the playbook attached to the Case Alert.
GoogleSecOps.CaseAlert.eventCount Number The number of events that triggered the Case Alert.
GoogleSecOps.CaseAlert.playbookRunCount Number The number of times the first playbook was run for the Case Alert.
GoogleSecOps.CaseAlert.createTime String The creation time of the Case Alert (unix epoch milliseconds).
GoogleSecOps.CaseAlert.updateTime String The last update time of the Case Alert (unix epoch milliseconds).
GoogleSecOps.CaseAlert.startTime String The time the alert was created on the third-party system.
GoogleSecOps.CaseAlert.endTime String The time the alert was closed on the third-party system.
GoogleSecOps.CaseAlert.sla.slaStatus String The SLA expiration status of the Case Alert.
GoogleSecOps.CaseAlert.sla.slaExpireTime String The SLA expiration time of the Case Alert.
GoogleSecOps.CaseAlert.tags.tag String The tag value associated with the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.reason String The closure reason of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.comment String The closure comment of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.rootCause String The root cause provided at closure of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.closingTimeMs String The closure time of the Case Alert in Unix milliseconds.
GoogleSecOps.CaseAlert.involvedRelations.identifier String The identifier of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.alertIdentifier String The identifier of the alert the Involved Relation belongs to.
GoogleSecOps.CaseAlert.involvedRelations.caseId Number The Case ID the Involved Relation belongs to.
GoogleSecOps.CaseAlert.involvedRelations.relationType String The type of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.deviceProduct String The product associated with the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.deviceVendor String The vendor associated with the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.categoryOutcome String The category outcome of the Involved Relation (e.g. Blocked, Allowed).
GoogleSecOps.CaseAlert.involvedRelations.destinationPort String The destination port of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.eventClassId String The event display name of the Involved Relation (e.g. Email Check, Data Exfiltration).
GoogleSecOps.CaseAlert.involvedRelations.startTime String The start time of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.endTime String The end time of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.additionalProperties String The additional data of the Involved Relation as a JSON string.
GoogleSecOps.CaseAlert.involvedRelations.from.identifier String The identifier of the source entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.from.type String The type of the source entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.to.identifier String The identifier of the destination entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.to.type String The type of the destination entity of the Involved Relation.

Command Example

!gcb-case-alert-get case_id=1001 alert_id=1000001

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "name": "projects/chronicle-mock-proj/locations/us/instances/00000000-0000-0000-0000-000000000001/cases/1001/caseAlerts/1000001",
            "alertId": "1000001",
            "identifier": "TEST ALERT_00000000-0000-0000-0000-000000000010",
            "caseId": 1001,
            "createTime": "1778778979232",
            "updateTime": "1779426987796",
            "ruleGenerator": "Test-Alert-Rule-01",
            "sourceGroupingIdentifier": "0.0.0.1",
            "product": "Test Product",
            "displayName": "TEST ALERT",
            "vendor": "Test Vendor",
            "environment": "Default Environment",
            "ticketId": "0.0.0.1_2026-05-10 08:00:00",
            "sourceSystemName": "Test Source System",
            "closureDetails": {
                "reason": "NOT_MALICIOUS",
                "comment": "Testing",
                "rootCause": "False positive from detection rule",
                "closingTimeMs": "1779447705049"
            },
            "sla": {
                "expirationTime": "1780832620238",
                "expirationStatus": "OPEN_SLA"
            },
            "priority": "HIGH",
            "sourceIdentifier": "Test Source Identifier_00000000-0000-0000-0000-000000000011",
            "additionalProperties": "{\"Name\":\"TEST ALERT\",\"Type\":\"ALERT\",\"EndTime\":\"1779426987796\",\"Alert_Id\":\"0.0.0.1_2026-05-10 08:00:00\",\"TicketId\":\"0.0.0.1_2026-05-10 08:00:00\",\"DisplayId\":\"0.0.0.1_2026-05-10 08:00:00\",\"StartTime\":\"1778778979232\",\"IsArtifact\":\"False\",\"IsEnriched\":\"False\",\"IsTestCase\":\"False\",\"Description\":\"Test alert description.\",\"Environment\":\"Default Environment\",\"IsSuspicious\":\"False\",\"IsVulnerable\":\"False\",\"DataAccessScope\":null,\"IsInternalAsset\":\"False\",\"IsSkipPlaybooks\":null,\"AlertBaseEventIds\":\"00000000-0000-0000-0000-000000000012\",\"EstimatedStartTime\":\"1778778979232\"}",
            "status": "OPEN",
            "startTime": "1778778979232",
            "endTime": "1779426987796",
            "playbookStatus": "COMPLETED",
            "attachedPlaybookName": "Test Playbook",
            "alertGroupIdentifier": "TEST ALERT_00000000-0000-0000-0000-000000000010",
            "eventCount": 5,
            "playbookRunCount": 1,
            "tags": [
                {
                    "tag": "demo_1"
                },
                {
                    "tag": "demo_2"
                }
            ],
            "involvedRelations": [
                {
                    "identifier": "00000000-0000-0000-0000-000000000020",
                    "alertIdentifier": "TEST ALERT_00000000-0000-0000-0000-000000000010",
                    "caseId": 1001,
                    "relationType": "ALERT",
                    "from": {
                        "identifier": "0.0.0.1",
                        "type": "ADDRESS"
                    },
                    "to": {
                        "identifier": "test-host-01",
                        "type": "HOSTNAME"
                    },
                    "deviceProduct": "Test Product",
                    "deviceVendor": "Test Vendor",
                    "categoryOutcome": "Blocked",
                    "destinationPort": "443",
                    "eventClassId": "Test Event Class"
                }
            ]
        }
    }
}

Human Readable Output

Case Alert Information

Alert ID Case ID Display Name Status Priority Product Vendor Environment Tags SLA Event Count Alert Identifier Alert Group Identifier Playbook Status Attached Playbook Name Playbook Run Count Create Time Update Time Start Time End Time Manual Rule Generator Ticket ID Source System Name Source Identifier Source Grouping Identifier Siem Alert ID Source URL Additional Properties Closure Details Involved Relations
1000001 1001 TEST ALERT OPEN HIGH Test Product Test Vendor Default Environment demo_1, demo_2 Status: OPEN_SLA
Expiration Time: 2026-06-07 11:43:40 UTC		 5 TEST ALERT_00000000-0000-0000-0000-000000000010 TEST ALERT_00000000-0000-0000-0000-000000000010 COMPLETED Test Playbook 1 2026-05-14 17:16:19 UTC 2026-05-22 05:16:27 UTC 2026-05-14 17:16:19 UTC 2026-05-22 05:16:27 UTC False Test-Alert-Rule-01 0.0.0.1_2026-05-10 08:00:00 Test Source System Test Source Identifier_00000000-0000-0000-0000-000000000011 0.0.0.1 0.0.0.1_2026-05-10 08:00:00 http://demo.com/alerts/1000001 {“Name”:”TEST ALERT”,”Type”:”ALERT”,”EndTime”:”1779426987796”,”Alert_Id”:”0.0.0.1_2026-05-10 08:00:00”,”TicketId”:”0.0.0.1_2026-05-10 08:00:00”,”DisplayId”:”0.0.0.1_2026-05-10 08:00:00”,”StartTime”:”1778778979232”,”IsArtifact”:”False”,”IsEnriched”:”False”,”IsTestCase”:”False”,”Description”:”Test alert description.”,”Environment”:”Default Environment”,”IsSuspicious”:”False”,”IsVulnerable”:”False”,”DataAccessScope”:null,”IsInternalAsset”:”False”,”IsSkipPlaybooks”:null,”AlertBaseEventIds”:”00000000-0000-0000-0000-000000000012”,”EstimatedStartTime”:”1778778979232”} reason: NOT_MALICIOUS
comment: Testing
rootCause: False positive from detection rule
closingTimeMs: 1779447705049		 - identifier: 00000000-0000-0000-0000-000000000020
alertIdentifier: TEST ALERT_00000000-0000-0000-0000-000000000010
caseId: 1001
relationType: ALERT
from:
identifier: 0.0.0.1
type: ADDRESS
to:
identifier: test-host-01
type: HOSTNAME
deviceProduct: Test Product
deviceVendor: Test Vendor
categoryOutcome: Blocked
destinationPort: 443
eventClassId: Test Event Class

gcb-case-alert-update

Update the properties of an existing case alert.

Base Command

gcb-case-alert-update

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to update.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
status Specify the new status for the alert. Possible values are: ALERT_STATUS_UNSPECIFIED, OPEN, CLOSE. Optional
priority Specify the new priority for the alert. Possible values are: LEGACY_CASE_PRIORITY_UNSPECIFIED, UNCHANGED, INFORMATIVE, LOW, MEDIUM, HIGH, CRITICAL. Optional
close_reason Specify the reason for closing the alert.

Note: Required when status is CLOSE. Possible values are: MALICIOUS, NOT_MALICIOUS, MAINTENANCE, INCONCLUSIVE, UNKNOWN, CLOSE_REASON_UNSPECIFIED.		 Optional
close_comment Specify a comment to add when closing the alert. Optional
root_cause Specify the root cause for the alert closure.

Note: Required when status is CLOSE.		 Optional

Context Output

Path Type Description
GoogleSecOps.CaseAlert.name String The unique resource name of the Case Alert.
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert extracted from the resource name.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.identifier String The legacy identifier (alert title + GUID) of the Case Alert.
GoogleSecOps.CaseAlert.sourceGroupingIdentifier String The source grouping identifier used to group related Case Alerts.
GoogleSecOps.CaseAlert.alertGroupIdentifier String The alert group identifier of the Case Alert.
GoogleSecOps.CaseAlert.displayName String The display name of the Case Alert.
GoogleSecOps.CaseAlert.product String The product associated with the Case Alert.
GoogleSecOps.CaseAlert.vendor String The vendor associated with the Case Alert.
GoogleSecOps.CaseAlert.environment String The environment of the Case Alert.
GoogleSecOps.CaseAlert.sourceSystemName String The alerting system that raised the Case Alert.
GoogleSecOps.CaseAlert.sourceIdentifier String The source identifier (e.g. connector ID) of the Case Alert.
GoogleSecOps.CaseAlert.ruleGenerator String The third-party rule that triggered the Case Alert.
GoogleSecOps.CaseAlert.siemAlertId String The SIEM alert identifier of the Case Alert.
GoogleSecOps.CaseAlert.sourceUrl String The source URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceRuleUrl String The source rule URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceSystemUrl String The source system URL of the Case Alert.
GoogleSecOps.CaseAlert.sourceRuleIdentifier String The source rule identifier of the Case Alert.
GoogleSecOps.CaseAlert.ticketId String The ticket ID linked to the Case Alert in the integrated ticketing system.
GoogleSecOps.CaseAlert.additionalProperties String The additional connector data of the Case Alert as a JSON string.
GoogleSecOps.CaseAlert.priority String The priority of the Case Alert.
GoogleSecOps.CaseAlert.status String The status of the Case Alert.
GoogleSecOps.CaseAlert.manual Boolean Whether the Case Alert was created manually.
GoogleSecOps.CaseAlert.nestingDepth Number The nesting depth level of the Case Alert.
GoogleSecOps.CaseAlert.playbookStatus String The playbook or workflow status of the Case Alert.
GoogleSecOps.CaseAlert.attachedPlaybookName String The name of the playbook attached to the Case Alert.
GoogleSecOps.CaseAlert.eventCount Number The number of events that triggered the Case Alert.
GoogleSecOps.CaseAlert.playbookRunCount Number The number of times the first playbook was run for the Case Alert.
GoogleSecOps.CaseAlert.createTime String The creation time of the Case Alert (unix epoch milliseconds).
GoogleSecOps.CaseAlert.updateTime String The last update time of the Case Alert (unix epoch milliseconds).
GoogleSecOps.CaseAlert.startTime String The time the alert was created on the third-party system.
GoogleSecOps.CaseAlert.endTime String The time the alert was closed on the third-party system.
GoogleSecOps.CaseAlert.sla.slaStatus String The SLA expiration status of the Case Alert.
GoogleSecOps.CaseAlert.sla.slaExpireTime String The SLA expiration time of the Case Alert.
GoogleSecOps.CaseAlert.tags.tag String The tag value associated with the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.reason String The closure reason of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.comment String The closure comment of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.rootCause String The root cause provided at closure of the Case Alert.
GoogleSecOps.CaseAlert.closureDetails.closingTimeMs String The closure time of the Case Alert in Unix milliseconds.
GoogleSecOps.CaseAlert.involvedRelations.identifier String The identifier of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.alertIdentifier String The identifier of the alert the Involved Relation belongs to.
GoogleSecOps.CaseAlert.involvedRelations.caseId Number The Case ID the Involved Relation belongs to.
GoogleSecOps.CaseAlert.involvedRelations.relationType String The type of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.deviceProduct String The product associated with the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.deviceVendor String The vendor associated with the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.categoryOutcome String The category outcome of the Involved Relation (e.g. Blocked, Allowed).
GoogleSecOps.CaseAlert.involvedRelations.destinationPort String The destination port of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.eventClassId String The event display name of the Involved Relation (e.g. Email Check, Data Exfiltration).
GoogleSecOps.CaseAlert.involvedRelations.startTime String The start time of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.endTime String The end time of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.additionalProperties String The additional data of the Involved Relation as a JSON string.
GoogleSecOps.CaseAlert.involvedRelations.from.identifier String The identifier of the source entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.from.type String The type of the source entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.to.identifier String The identifier of the destination entity of the Involved Relation.
GoogleSecOps.CaseAlert.involvedRelations.to.type String The type of the destination entity of the Involved Relation.

Command example

!gcb-case-alert-update case_id=1001 alert_id=1000001 status=CLOSE priority=HIGH close_reason=NOT_MALICIOUS close_comment="Reviewed and confirmed as false positive." root_cause="Misconfigured DLP policy"

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "alertId": "1000001",
            "identifier": "TEST ALERT_00000000-0000-0000-0000-000000000010",
            "caseId": 1001,
            "createTime": "1778778979232",
            "updateTime": "1779426987796",
            "ruleGenerator": "Test-Alert-Rule-01",
            "sourceGroupingIdentifier": "0.0.0.1",
            "product": "Test Product",
            "displayName": "TEST ALERT",
            "vendor": "Test Vendor",
            "environment": "Default Environment",
            "ticketId": "0.0.0.1_2026-05-10 08:00:00",
            "sourceSystemName": "Test Source System",
            "closureDetails": {
                "reason": "NOT_MALICIOUS",
                "comment": "Reviewed and confirmed as false positive.",
                "rootCause": "Misconfigured DLP policy",
                "closingTimeMs": "1779447705049"
            },
            "sla": {
                "expirationTime": "1780832620238",
                "expirationStatus": "OPEN_SLA"
            },
            "priority": "HIGH",
            "additionalProperties": "{\"Name\":\"TEST ALERT\",\"Type\":\"ALERT\"}",
            "status": "CLOSE",
            "startTime": "1778778979232",
            "endTime": "1779426987796",
            "alertGroupIdentifier": "TEST ALERT_00000000-0000-0000-0000-000000000010"
        }
    }
}

Human Readable Output

Updated Case Alert Information

Alert ID Case ID Display Name Status Priority Product Vendor Environment SLA Alert Identifier Alert Group Identifier Create Time Update Time Start Time End Time Manual Rule Generator Ticket ID Source System Name Source Grouping Identifier Additional Properties Closure Details
1000001 1001 TEST ALERT CLOSE HIGH Test Product Test Vendor Default Environment Status: OPEN_SLA
Expiration Time: 2026-06-07 11:43:40 UTC		 TEST ALERT_00000000-0000-0000-0000-000000000010 TEST ALERT_00000000-0000-0000-0000-000000000010 2026-05-14 17:16:19 UTC 2026-05-22 05:16:27 UTC 2026-05-14 17:16:19 UTC 2026-05-22 05:16:27 UTC False Test-Alert-Rule-01 0.0.0.1_2026-05-10 08:00:00 Test Source System 0.0.0.1 {“Name”:”TEST ALERT”,”Type”:”ALERT”} reason: NOT_MALICIOUS
comment: Reviewed and confirmed as false positive.
rootCause: Misconfigured DLP policy
closingTimeMs: 1779447705049

gcb-case-alert-tag-add

Add a tag to a case alert.

Base Command

gcb-case-alert-tag-add

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to add a tag.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
tag Specify the tag to add to the alert. Required

Context Output

Path Type Description
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.recentlyAddedTag String The recently added tag.

Command example

!gcb-case-alert-tag-add case_id=1001 alert_id=1142656 tag=insider-threat

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "alertId": "1142656",
            "caseId": 1001,
            "recentlyAddedTag": "insider-threat"
        }
    }
}

Human Readable Output

Tag insider-threat successfully added to alert 1142656.

gcb-case-alert-tag-remove

Remove a tag from a case alert.

Base Command

gcb-case-alert-tag-remove

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to remove a tag.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
tag Specify the tag to remove from the alert. Required

Context Output

Path Type Description
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.recentlyRemovedTag String The tag that was recently removed from the case alert.

Command example

!gcb-case-alert-tag-remove case_id=1001 alert_id=1142656 tag=insider-threat

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "alertId": "1142656",
            "caseId": 1001,
            "recentlyRemovedTag": "insider-threat"
        }
    }
}

Human Readable Output

Tag insider-threat successfully removed from alert 1142656.

gcb-case-alert-move

Move a case alert to a different case.

Note: Both source and destination cases must be open.

Base Command

gcb-case-alert-move

Input

Argument Name Description Required
case_id Specify the ID of the source case.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to move.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
destination_case_id Specify the destination case ID to move the alert to.

Note: Use gcb-case-list to retrieve destination case ID.		 Required

Context Output

Path Type Description
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert.
GoogleSecOps.CaseAlert.caseId Number The Case ID the alert was moved to.

Command example

!gcb-case-alert-move case_id=1001 alert_id=1142656 destination_case_id=1005

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "alertId": "1142656",
            "caseId": 1005
        }
    }
}

Human Readable Output

Successfully moved Alert 1142656 to Case 1005.

gcb-case-alert-sla-pause

Pause the SLA timer for the specified case alert.

Base Command

gcb-case-alert-sla-pause

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to pause the SLA timer.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
message Specify the reason for pausing the SLA timer. Optional

Context Output

Path Type Description
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.slaExpirationStatus String The SLA expiration status of the Case Alert after the operation.

Command example

!gcb-case-alert-sla-pause case_id=1001 alert_id=1142656 message="Pausing SLA pending additional investigation."

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "alertId": "1142656",
            "caseId": "1001",
            "slaExpirationStatus": "PAUSED"
        }
    }
}

Human Readable Output

SLA timer for alert 1142656 successfully paused.

gcb-case-alert-sla-resume

Resume the SLA timer for the specified case alert.

Base Command

gcb-case-alert-sla-resume

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to resume the SLA timer.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required

Context Output

Path Type Description
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.slaExpirationStatus String The SLA expiration status of the Case Alert after the operation.

Command example

!gcb-case-alert-sla-resume case_id=1001 alert_id=1142656

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "alertId": "1142656",
            "caseId": "1001",
            "slaExpirationStatus": "SLA_EXPIRATION_STATUS_UNSPECIFIED"
        }
    }
}

Human Readable Output

SLA timer for alert 1142656 successfully resumed.

gcb-case-alert-sla-set

Set the SLA parameters for a case alert.

Note: When critical_time is specified, total_time must be greater than critical_time.

Base Command

gcb-case-alert-sla-set

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to set the SLA.

Note: The alert must be open. Use gcb-case-alert-list to retrieve alert ID.		 Required
total_time Specify the total SLA duration.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 2 weeks, 01 May 2026, 2026-05-17T14:05:44Z.		 Required
critical_time Specify the critical SLA threshold.

Note: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 2 weeks, 01 May 2026, 2026-05-17T14:05:44Z.		 Optional

Context Output

Path Type Description
GoogleSecOps.CaseAlert.alertId String The ID of the Case Alert.
GoogleSecOps.CaseAlert.caseId Number The ID of the Case the alert belongs to.
GoogleSecOps.CaseAlert.slaExpirationTime String The SLA expiration time of the Case Alert (epoch ms).
GoogleSecOps.CaseAlert.slaCriticalExpirationTime String The SLA critical expiration time of the Case Alert (epoch ms).

Command example

!gcb-case-alert-sla-set case_id=1001 alert_id=1142656 total_time="2 days" critical_time="1 day"

Context Example

{
    "GoogleSecOps": {
        "CaseAlert": {
            "alertId": "1142656",
            "caseId": "1001",
            "slaExpirationTime": "1746266400000",
            "slaCriticalExpirationTime": "1746180000000"
        }
    }
}

Human Readable Output

SLA for Alert 1142656 successfully set.

gcb-case-alert-recommendation-create

Initiate an asynchronous AI recommendation for a case alert.

Base Command

gcb-case-alert-recommendation-create

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to generate a recommendation.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required

Context Output

Path Type Description
GoogleSecOps.AlertRecommendation.parent String The resource name of the Case Alert the recommendation belongs to.
GoogleSecOps.AlertRecommendation.recommendationId String The ID of the created recommendation.

Command example

!gcb-case-alert-recommendation-create case_id=1001 alert_id=1000001

Context Example

{
    "GoogleSecOps": {
        "AlertRecommendation": {
            "recommendationId": "00000000-0000-0000-0000-000000000001"
        }
    }
}

Human Readable Output

Successfully created the recommendation for the alert 1000001.

Recommendation ID: 00000000-0000-0000-0000-000000000001

gcb-case-alert-recommendation-fetch

Fetch a previously generated AI recommendation for a case alert.

Base Command

gcb-case-alert-recommendation-fetch

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
recommendation_id Specify the recommendation ID returned by gcb-case-alert-recommendation-create command. Required

Context Output

Path Type Description
GoogleSecOps.AlertRecommendation.parent String The resource name of the Case Alert the recommendation belongs to.
GoogleSecOps.AlertRecommendation.recommendationId String The ID of the recommendation.
GoogleSecOps.AlertRecommendation.recommendation String The AI-generated recommendation text for the Case Alert.
GoogleSecOps.AlertRecommendation.alertIdentifierToCaseId Unknown Mapping of alert identifiers to their associated Case IDs.
GoogleSecOps.AlertRecommendation.marketplaceActionsTriggeredManually Unknown List of marketplace actions that were manually triggered on the alert.
GoogleSecOps.AlertRecommendation.state String The current state of the recommendation generation.

Command example

!gcb-case-alert-recommendation-fetch case_id=1001 recommendation_id=00000000-0000-0000-0000-000000001000

Context Example

{
    "GoogleSecOps": {
        "AlertRecommendation": {
            "recommendationId": "00000000-0000-0000-0000-000000001000",
            "recommendation": "*Step 1: Closure Recommendation*\n\nClose the alert as \"Malicious\".",
            "alertIdentifierToCaseId": {
                "sample_alert_00000000-0000-0000-0000-000000000001": 100001,
                "sample_alert_00000000-0000-0000-0000-000000000002": 100002
            },
            "marketplaceActionsTriggeredManually": [
                "Enrich Web Properties",
                "Enrich IPs"
            ],
            "state": "SUCCEEDED"
        }
    }
}

Human Readable Output

Alert Recommendation

State: SUCCEEDED

Recommendation:
Step 1: Closure Recommendation

Close the alert as “Malicious”.

Alert Identifier To Case ID:

  • sample_alert_00000000-0000-0000-0000-000000000001: 100001
  • sample_alert_00000000-0000-0000-0000-000000000002: 100002

Marketplace Actions Triggered Manually: Enrich Web Properties, Enrich IPs

gcb-case-alert-customfield-list

Retrieve the list of custom field values associated with a case alert.

Base Command

gcb-case-alert-customfield-list

Input

Argument Name Description Required
case_id Specify the ID of the case the alert belongs to.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to list custom field values.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
page_size Specify the maximum number of custom field values to return.

Note: Maximum value is 1000. Default is 50.		 Optional
page_token Specify the page token for pagination.

Note: Use the next_page_token from a previous gcb-case-alert-customfield-list response.		 Optional

Context Output

Path Type Description
GoogleSecOps.AlertCustomFieldValue.name String The unique resource name of the Custom Field Value.
GoogleSecOps.AlertCustomFieldValue.customFieldId String The ID of the parent Custom Field.
GoogleSecOps.AlertCustomFieldValue.displayName String The display name of the Custom Field resolved from the custom field ID.
GoogleSecOps.AlertCustomFieldValue.scope String The scope of the Custom Field Value.
GoogleSecOps.AlertCustomFieldValue.scopeId String The identifier of the scope (case or alert) this value references.
GoogleSecOps.AlertCustomFieldValue.values Unknown The value(s) for the Custom Field.
GoogleSecOps.AlertCustomFieldValue.valuesSearchText String The concatenated search text for all values of the Custom Field.
GoogleSecOps.PageToken.command String The command name for which the page token applies.
GoogleSecOps.PageToken.nextPageToken String The token to retrieve the next page of Custom Field Values.
GoogleSecOps.PageToken.totalSize Number The total number of Custom Field Values available.

Command example

!gcb-case-alert-customfield-list case_id=1001 alert_id=2001

Context Example

{
    "GoogleSecOps": {
        "AlertCustomFieldValue": [
            {
                "customFieldId": "1",
                "displayName": "Ticket Priority",
                "scope": "ALERT",
                "values": [
                    "High"
                ],
                "valuesSearchText": "High"
            },
            {
                "customFieldId": "2",
                "displayName": "Escalation Required",
                "scope": "ALERT",
                "values": [
                    "Yes"
                ],
                "valuesSearchText": "Yes"
            },
            {
                "customFieldId": "3",
                "displayName": "Affected Systems",
                "scope": "ALERT",
                "values": [
                    "Web Server",
                    "Database"
                ],
                "valuesSearchText": "Web Server Database"
            }
        ],
        "PageToken": {
            "command": "gcb-case-alert-customfield-list",
            "nextPageToken": "test-next-page-token",
            "totalSize": 10
        }
    }
}

Human Readable Output

Case Alert Custom Field Values

Custom Field ID Display Name Values Values Search Text
1 Ticket Priority High High
2 Escalation Required Yes Yes
3 Affected Systems Web Server, Database Web Server Database

Maximum number of custom field values specified in page_size has been returned. To fetch the next set of custom field values, execute the command with the page token as test-next-page-token.

gcb-case-alert-entity-list

Retrieve the list of entities associated with a case alert.

Base Command

gcb-case-alert-entity-list

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert to list entities.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
page_size Specify the maximum number of entities to return.

Note: Maximum value is 1000. Default is 50.		 Optional
page_token Specify the page token for pagination.

Note: Use the next_page_token from a previous gcb-case-alert-entity-list response.		 Optional
entity_type Filter entities by type. Supports comma-separated values. Possible values are: ADDRESS, HOSTNAME, PROCESS, USB. Optional
suspicious Filter entities by suspicious status. Possible values are: true, false. Optional
internal Filter entities by internal status. Possible values are: true, false. Optional
attacker Filter entities by attacker designation. Possible values are: true, false. Optional
pivot Filter entities by pivot designation. Possible values are: true, false. Optional
enriched Filter entities by enrichment status. Possible values are: true, false. Optional
artifact Filter entities by artifact flag. Possible values are: true, false. Optional
vulnerable Filter entities by vulnerable flag. Possible values are: true, false. Optional
manually_created Filter entities by manually created flag. Possible values are: true, false. Optional
threat_source Filter entities by threat source. Supports comma-separated values. Optional
operating_system Filter entities by operating system. Supports comma-separated values. Optional
network_title Filter entities by network name. Supports comma-separated values. Optional
network_priority Filter entities by network priority (integer values). Supports comma-separated values. Optional
environment Filter entities by environment. Supports comma-separated values. Optional
advanced_filter Specify a raw filter expression to query entities with advanced conditions. When provided, this filter is used as-is and all other filter arguments are ignored.

Note: Supported filter fields: type, suspicious, internal, attacker, pivot, enriched, artifact, vulnerable, manuallyCreated, threatSource, operatingSystem, networkTitle, networkPriority, environment, fields.

Example: type=’ADDRESS’ AND suspicious=true AND internal=false.		 Optional
sort_by Specify the field to sort results by. Possible values are: id, entityType, suspicious, internal, attacker, pivot, enriched, artifact, vulnerable, manuallyCreated, threatSource, operatingSystem, networkTitle, networkPriority, environment. Default is id. Optional
sort_order Specify the sort direction for the results. Possible values are: Asc, Desc. Default is Desc. Optional
filter_logic Specify the logical operator to combine filter conditions. Possible values are: AND, OR. Default is AND. Optional

Context Output

Path Type Description
GoogleSecOps.AlertEntity.id String The immutable identifier of the Involved Entity.
GoogleSecOps.AlertEntity.identifier String The identifier name of the Involved Entity.
GoogleSecOps.AlertEntity.type String The type of the Involved Entity.
GoogleSecOps.AlertEntity.caseId Number The Case ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.alertIdentifier String The alert identifier the Involved Entity belongs to.
GoogleSecOps.AlertEntity.environment String The environment of the Involved Entity.
GoogleSecOps.AlertEntity.threatSource String The threat source associated with the Involved Entity.
GoogleSecOps.AlertEntity.operatingSystem String The operating system of the Involved Entity.
GoogleSecOps.AlertEntity.networkTitle String The network name related to the Involved Entity.
GoogleSecOps.AlertEntity.networkPriority Number The network priority of the Involved Entity.
GoogleSecOps.AlertEntity.entityUri String The full URL of the Involved Entity in the source system.
GoogleSecOps.AlertEntity.sourceSystemUri String The source system URI link of the Involved Entity.
GoogleSecOps.AlertEntity.additionalProperties String The additional properties of the Involved Entity as a JSON string.
GoogleSecOps.AlertEntity.suspicious Boolean Whether the Involved Entity is considered suspicious.
GoogleSecOps.AlertEntity.internal Boolean Whether the Involved Entity is internal.
GoogleSecOps.AlertEntity.attacker Boolean Whether the Involved Entity represents an attacker.
GoogleSecOps.AlertEntity.pivot Boolean Whether the Involved Entity is a pivot entity common to multiple cases.
GoogleSecOps.AlertEntity.manuallyCreated Boolean Whether the Involved Entity was added manually.
GoogleSecOps.AlertEntity.enriched Boolean Whether the Involved Entity has been enriched by an external action.
GoogleSecOps.AlertEntity.artifact Boolean Whether the Involved Entity is an artifact.
GoogleSecOps.AlertEntity.vulnerable Boolean Whether the Involved Entity is vulnerable.
GoogleSecOps.AlertEntity.fields.displayName String The display name of the context group of the Involved Entity.
GoogleSecOps.AlertEntity.fields.highlighted Boolean Whether the context group of the Involved Entity is highlighted.
GoogleSecOps.AlertEntity.fields.hidden Boolean Whether the context group of the Involved Entity is hidden.
GoogleSecOps.AlertEntity.fields.items.name String The property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.originalName String The original property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.value String The value of the context group item of the Involved Entity.
GoogleSecOps.PageToken.command String The command name associated with the pagination token.
GoogleSecOps.PageToken.nextPageToken String Token to fetch the next page of alert entities.
GoogleSecOps.PageToken.totalSize Number The total number of alert entities available.

Command example

!gcb-case-alert-entity-list case_id=306082 alert_id=1001

Context Example

{
    "GoogleSecOps": {
        "AlertEntity": [
            {
                "id": "376359",
                "type": "ADDRESS",
                "suspicious": true,
                "internal": true,
                "networkPriority": 0,
                "attacker": false,
                "pivot": false,
                "environment": "Default Environment",
                "manuallyCreated": false,
                "additionalProperties": "{\"Type\":\"ADDRESS\",\"IsArtifact\":\"False\",\"IsEnriched\":\"False\",\"IsVulnerable\":\"False\",\"IsInternalAsset\":\"True\",\"OriginalIdentifier\":\"999.999.999.999\"}",
                "enriched": false,
                "artifact": false,
                "vulnerable": false,
                "entityUri": "/entity?indicator=999.999.999.999&type=ipAddress",
                "fields": [
                    {
                        "displayName": "Default",
                        "highlighted": false,
                        "hidden": false,
                        "items": [
                            {"name": "Network_Priority", "originalName": "Network_Priority", "value": "0"},
                            {"name": "IsSuspicious", "originalName": "IsSuspicious", "value": "True"}
                        ]
                    },
                    {
                        "displayName": "Entity",
                        "highlighted": false,
                        "hidden": false,
                        "items": [
                            {"name": "Is Pivot", "originalName": "IsPivot", "value": "False"}
                        ]
                    }
                ],
                "alertIdentifier": "Testing Alert_62923d4f-05f0-47bf-9290-d0c94406e775",
                "caseId": 306082,
                "identifier": "999.999.999.999"
            },
            {
                "id": "376358",
                "type": "ADDRESS",
                "suspicious": false,
                "internal": false,
                "networkPriority": 0,
                "attacker": false,
                "pivot": false,
                "environment": "Default Environment",
                "manuallyCreated": false,
                "additionalProperties": "{\"Type\":\"ADDRESS\",\"IsArtifact\":\"False\",\"IsEnriched\":\"True\",\"Censys_ports\":\"53, 443, 853\",\"IsVulnerable\":\"False\",\"IsInternalAsset\":\"False\",\"OriginalIdentifier\":\"8.8.8.8\"}",
                "enriched": true,
                "artifact": false,
                "vulnerable": false,
                "entityUri": "/entity?indicator=8.8.8.8&type=ipAddress",
                "fields": [
                    {
                        "displayName": "Default",
                        "highlighted": false,
                        "hidden": false,
                        "items": [
                            {"name": "Network_Priority", "originalName": "Network_Priority", "value": "0"},
                            {"name": "IsSuspicious", "originalName": "IsSuspicious", "value": "False"}
                        ]
                    },
                    {
                        "displayName": "Entity",
                        "highlighted": false,
                        "hidden": false,
                        "items": [
                            {"name": "Is Pivot", "originalName": "IsPivot", "value": "False"}
                        ]
                    }
                ],
                "alertIdentifier": "Testing Alert_62923d4f-05f0-47bf-9290-d0c94406e775",
                "caseId": 306082,
                "identifier": "8.8.8.8"
            }
        ]
    }
}

Human Readable Output

Alert Entities List

ID Identifier Type Environment Suspicious Internal Attacker Pivot Enriched Artifact Vulnerable Manually Created Network Priority Entity URI
376359 999.999.999.999 ADDRESS Default Environment True True False False False False False False 0 /entity?indicator=999.999.999.999&type=ipAddress
376358 8.8.8.8 ADDRESS Default Environment False False False False True False False False 0 /entity?indicator=8.8.8.8&type=ipAddress

gcb-case-alert-entity-get

Retrieve detailed information about a specific involved entity in a case alert.

Base Command

gcb-case-alert-entity-get

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
entity_id Specify the ID of the involved entity to retrieve.

Note: Use gcb-case-alert-entity-list to retrieve entity ID.		 Required

Context Output

Path Type Description
GoogleSecOps.AlertEntity.id String The immutable identifier of the Involved Entity.
GoogleSecOps.AlertEntity.identifier String The identifier name of the Involved Entity.
GoogleSecOps.AlertEntity.type String The type of the Involved Entity.
GoogleSecOps.AlertEntity.alertId String The Alert ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.caseId Number The Case ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.alertIdentifier String The alert identifier the Involved Entity belongs to.
GoogleSecOps.AlertEntity.environment String The environment of the Involved Entity.
GoogleSecOps.AlertEntity.threatSource String The threat source associated with the Involved Entity.
GoogleSecOps.AlertEntity.operatingSystem String The operating system of the Involved Entity.
GoogleSecOps.AlertEntity.networkTitle String The network name related to the Involved Entity.
GoogleSecOps.AlertEntity.networkPriority Number The network priority of the Involved Entity.
GoogleSecOps.AlertEntity.entityUri String The full URL of the Involved Entity in the source system.
GoogleSecOps.AlertEntity.sourceSystemUri String The source system URI link of the Involved Entity.
GoogleSecOps.AlertEntity.additionalProperties String The additional properties of the Involved Entity as a JSON string.
GoogleSecOps.AlertEntity.suspicious Boolean Whether the Involved Entity is considered suspicious.
GoogleSecOps.AlertEntity.internal Boolean Whether the Involved Entity is internal.
GoogleSecOps.AlertEntity.attacker Boolean Whether the Involved Entity represents an attacker.
GoogleSecOps.AlertEntity.pivot Boolean Whether the Involved Entity is a pivot entity common to multiple cases.
GoogleSecOps.AlertEntity.manuallyCreated Boolean Whether the Involved Entity was added manually.
GoogleSecOps.AlertEntity.enriched Boolean Whether the Involved Entity has been enriched by an external action.
GoogleSecOps.AlertEntity.artifact Boolean Whether the Involved Entity is an artifact.
GoogleSecOps.AlertEntity.vulnerable Boolean Whether the Involved Entity is vulnerable.
GoogleSecOps.AlertEntity.fields.displayName String The display name of the context group of the Involved Entity.
GoogleSecOps.AlertEntity.fields.highlighted Boolean Whether the context group of the Involved Entity is highlighted.
GoogleSecOps.AlertEntity.fields.hidden Boolean Whether the context group of the Involved Entity is hidden.
GoogleSecOps.AlertEntity.fields.items.name String The property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.originalName String The original property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.value String The value of the context group item of the Involved Entity.

Command example

!gcb-case-alert-entity-get case_id=306082 alert_id=1001 entity_id=376359

Context Example

{
    "GoogleSecOps": {
        "AlertEntity": {
            "id": "376359",
            "type": "ADDRESS",
            "suspicious": false,
            "internal": false,
            "networkPriority": 0,
            "attacker": false,
            "pivot": false,
            "environment": "Default Environment",
            "manuallyCreated": false,
            "additionalProperties": "{\"Type\":\"ADDRESS\",\"IsArtifact\":\"False\",\"IsEnriched\":\"False\",\"IsVulnerable\":\"False\",\"IsInternalAsset\":\"False\",\"OriginalIdentifier\":\"999.999.999.999\"}",
            "enriched": false,
            "artifact": false,
            "vulnerable": false,
            "entityUri": "/entity?indicator=999.999.999.999&type=ipAddress",
            "fields": [
                {
                    "displayName": "Default",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {
                            "name": "Network_Priority",
                            "originalName": "Network_Priority",
                            "value": "0"
                        },
                        {
                            "name": "IsSuspicious",
                            "originalName": "IsSuspicious",
                            "value": "False"
                        },
                        {
                            "name": "IsAttacker",
                            "originalName": "IsAttacker",
                            "value": "False"
                        },
                        {
                            "name": "IsManuallyCreated",
                            "originalName": "IsManuallyCreated",
                            "value": "False"
                        },
                        {
                            "name": "Environment",
                            "originalName": "Environment",
                            "value": "Default Environment"
                        },
                        {
                            "name": "Alert_Id",
                            "originalName": "Alert_Id",
                            "value": "Testing Alert_62923d4f-05f0-47bf-9290-d0c94406e775"
                        },
                        {
                            "name": "Type",
                            "originalName": "Type",
                            "value": "ADDRESS"
                        },
                        {
                            "name": "IsArtifact",
                            "originalName": "IsArtifact",
                            "value": "False"
                        },
                        {
                            "name": "IsEnriched",
                            "originalName": "IsEnriched",
                            "value": "False"
                        },
                        {
                            "name": "IsVulnerable",
                            "originalName": "IsVulnerable",
                            "value": "False"
                        },
                        {
                            "name": "IsInternalAsset",
                            "originalName": "IsInternalAsset",
                            "value": "False"
                        },
                        {
                            "name": "OriginalIdentifier",
                            "originalName": "OriginalIdentifier",
                            "value": "999.999.999.999"
                        }
                    ]
                },
                {
                    "displayName": "Entity",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {
                            "name": "Is Pivot",
                            "originalName": "IsPivot",
                            "value": "False"
                        }
                    ]
                }
            ],
            "alertIdentifier": "Testing Alert_62923d4f-05f0-47bf-9290-d0c94406e775",
            "caseId": 306082,
            "alertId": "1001",
            "identifier": "999.999.999.999"
        }
    }
}

Human Readable Output

Entity Information

ID Identifier Alert ID Case ID Alert Identifier Type Environment Suspicious Internal Attacker Pivot Enriched Artifact Vulnerable Manually Created Network Priority Entity URI Additional Properties Fields
376359 999.999.999.999 1001 306082 Testing Alert_62923d4f-05f0-47bf-9290-d0c94406e775 ADDRESS Default Environment False False False False False False False False 0 /entity?indicator=999.999.999.999&type=ipAddress {“Type”:”ADDRESS”,”IsArtifact”:”False”,”IsEnriched”:”False”,”IsVulnerable”:”False”,”IsInternalAsset”:”False”,”OriginalIdentifier”:”999.999.999.999”} - displayName: Default
highlighted: False
hidden: False
items:
- name: Network_Priority
originalName: Network_Priority
value: 0
- name: IsSuspicious
originalName: IsSuspicious
value: False
- name: IsAttacker
originalName: IsAttacker
value: False
- name: IsManuallyCreated
originalName: IsManuallyCreated
value: False
- name: Environment
originalName: Environment
value: Default Environment
- name: Alert_Id
originalName: Alert_Id
value: Testing Alert_62923d4f-05f0-47bf-9290-d0c94406e775
- name: Type
originalName: Type
value: ADDRESS
- name: IsArtifact
originalName: IsArtifact
value: False
- name: IsEnriched
originalName: IsEnriched
value: False
- name: IsVulnerable
originalName: IsVulnerable
value: False
- name: IsInternalAsset
originalName: IsInternalAsset
value: False
- name: OriginalIdentifier
originalName: OriginalIdentifier
value: 999.999.999.999
- displayName: Entity
highlighted: False
hidden: False
items:
- name: Is Pivot
originalName: IsPivot
value: False

gcb-case-alert-entity-create

Manually create a new involved entity within a case alert.

Base Command

gcb-case-alert-entity-create

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
identifier Specify the identifier name of the entity (e.g. IP address, hostname value, process name). Required
entity_type Specify the type of the new entity.

Note: Immutable after creation. Possible values are: ADDRESS, HOSTNAME, PROCESS, USB.		 Required
suspicious Specify whether the entity is suspicious. Possible values are: true, false. Default is false. Optional
internal Specify whether the entity is internal to the organization. Possible values are: true, false. Default is false. Optional
attacker Specify whether the entity represents an attacker. Possible values are: true, false. Optional
pivot Specify whether the entity is a pivot entity common to multiple cases. Possible values are: true, false. Optional
operating_system Specify the operating system of the entity. Optional
network_title Specify the network name related to the entity. Optional
threat_source Specify the threat source name associated with the entity. Optional
network_priority Specify the network priority of the entity (non-negative integer). Optional

Context Output

Path Type Description
GoogleSecOps.AlertEntity.id String The immutable identifier of the Involved Entity.
GoogleSecOps.AlertEntity.identifier String The identifier name of the Involved Entity.
GoogleSecOps.AlertEntity.type String The type of the Involved Entity.
GoogleSecOps.AlertEntity.alertId String The Alert ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.caseId Number The Case ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.alertIdentifier String The alert identifier the Involved Entity belongs to.
GoogleSecOps.AlertEntity.environment String The environment of the Involved Entity.
GoogleSecOps.AlertEntity.threatSource String The threat source associated with the Involved Entity.
GoogleSecOps.AlertEntity.operatingSystem String The operating system of the Involved Entity.
GoogleSecOps.AlertEntity.networkTitle String The network name related to the Involved Entity.
GoogleSecOps.AlertEntity.networkPriority Number The network priority of the Involved Entity.
GoogleSecOps.AlertEntity.entityUri String The full URL of the Involved Entity in the source system.
GoogleSecOps.AlertEntity.sourceSystemUri String The source system URI link of the Involved Entity.
GoogleSecOps.AlertEntity.additionalProperties String The additional properties of the Involved Entity as a JSON string.
GoogleSecOps.AlertEntity.suspicious Boolean Whether the Involved Entity is considered suspicious.
GoogleSecOps.AlertEntity.internal Boolean Whether the Involved Entity is internal.
GoogleSecOps.AlertEntity.attacker Boolean Whether the Involved Entity represents an attacker.
GoogleSecOps.AlertEntity.pivot Boolean Whether the Involved Entity is a pivot entity common to multiple cases.
GoogleSecOps.AlertEntity.manuallyCreated Boolean Whether the Involved Entity was added manually.
GoogleSecOps.AlertEntity.enriched Boolean Whether the Involved Entity has been enriched by an external action.
GoogleSecOps.AlertEntity.artifact Boolean Whether the Involved Entity is an artifact.
GoogleSecOps.AlertEntity.vulnerable Boolean Whether the Involved Entity is vulnerable.
GoogleSecOps.AlertEntity.fields.displayName String The display name of the context group of the Involved Entity.
GoogleSecOps.AlertEntity.fields.highlighted Boolean Whether the context group of the Involved Entity is highlighted.
GoogleSecOps.AlertEntity.fields.hidden Boolean Whether the context group of the Involved Entity is hidden.
GoogleSecOps.AlertEntity.fields.items.name String The property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.originalName String The original property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.value String The value of the context group item of the Involved Entity.

Command example

!gcb-case-alert-entity-create case_id=123456 alert_id=1001 identifier=192.0.2.1 entity_type=ADDRESS suspicious=true

Context Example

{
    "GoogleSecOps": {
        "AlertEntity": {
            "id": "111111",
            "type": "ADDRESS",
            "suspicious": true,
            "internal": false,
            "networkPriority": 0,
            "attacker": false,
            "pivot": false,
            "environment": "Default Environment",
            "manuallyCreated": true,
            "additionalProperties": "{\"Type\":\"ADDRESS\",\"IsArtifact\":\"False\",\"IsEnriched\":\"False\",\"IsVulnerable\":\"False\",\"IsInternalAsset\":\"False\",\"OriginalIdentifier\":\"192.0.2.1\"}",
            "enriched": false,
            "artifact": false,
            "vulnerable": false,
            "fields": [
                {
                    "displayName": "Default",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {
                            "name": "Network_Priority",
                            "originalName": "Network_Priority",
                            "value": "0"
                        },
                        {
                            "name": "IsSuspicious",
                            "originalName": "IsSuspicious",
                            "value": "True"
                        },
                        {
                            "name": "IsAttacker",
                            "originalName": "IsAttacker",
                            "value": "False"
                        },
                        {
                            "name": "IsManuallyCreated",
                            "originalName": "IsManuallyCreated",
                            "value": "True"
                        },
                        {
                            "name": "Environment",
                            "originalName": "Environment",
                            "value": "Default Environment"
                        },
                        {
                            "name": "Alert_Id",
                            "originalName": "Alert_Id",
                            "value": "Testing Alert_00000000-0000-0000-0000-000000000001"
                        }
                    ]
                },
                {
                    "displayName": "Entity",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {
                            "name": "Is Pivot",
                            "originalName": "IsPivot",
                            "value": "False"
                        }
                    ]
                }
            ],
            "alertIdentifier": "Testing Alert_00000000-0000-0000-0000-000000000001",
            "caseId": 123456,
            "alertId": "1001",
            "identifier": "192.0.2.1"
        }
    }
}

Human Readable Output

Entity Information

ID Identifier Alert ID Case ID Alert Identifier Type Environment Suspicious Internal Attacker Pivot Enriched Artifact Vulnerable Manually Created Network Priority Additional Properties Fields
111111 192.0.2.1 1001 123456 Testing Alert_00000000-0000-0000-0000-000000000001 ADDRESS Default Environment True False False False False False False True 0 {“Type”:”ADDRESS”,”IsArtifact”:”False”,”IsEnriched”:”False”,”IsVulnerable”:”False”,”IsInternalAsset”:”False”,”OriginalIdentifier”:”192.0.2.1”} - displayName: Default
highlighted: False
hidden: False
items:
- name: Network_Priority
originalName: Network_Priority
value: 0
- name: IsSuspicious
originalName: IsSuspicious
value: True
- name: IsAttacker
originalName: IsAttacker
value: False
- name: IsManuallyCreated
originalName: IsManuallyCreated
value: True
- name: Environment
originalName: Environment
value: Default Environment
- name: Alert_Id
originalName: Alert_Id
value: Testing Alert_00000000-0000-0000-0000-000000000001
- displayName: Entity
highlighted: False
hidden: False
items:
- name: Is Pivot
originalName: IsPivot
value: False

gcb-case-alert-entity-update

Update the attributes of an existing involved entity in a case alert.

Base Command

gcb-case-alert-entity-update

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
entity_id Specify the ID of the involved entity to update.

Note: Use gcb-case-alert-entity-list to retrieve entity ID.		 Required
suspicious Specify the updated suspicion flag for the entity. Possible values are: true, false. Optional
internal Specify the updated internal flag for the entity. Possible values are: true, false. Optional
attacker Specify the updated attacker designation for the entity. Possible values are: true, false. Optional
pivot Specify the updated pivot designation for the entity. Possible values are: true, false. Optional
operating_system Specify the updated operating system of the entity. Optional
network_title Specify the updated network name related to the entity. Optional
threat_source Specify the updated threat source associated with the entity. Optional
network_priority Specify the updated network priority associated with the entity (non-negative integer). Optional

Context Output

Path Type Description
GoogleSecOps.AlertEntity.id String The immutable identifier of the Involved Entity.
GoogleSecOps.AlertEntity.identifier String The identifier name of the Involved Entity.
GoogleSecOps.AlertEntity.type String The type of the Involved Entity.
GoogleSecOps.AlertEntity.alertId String The Alert ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.caseId Number The Case ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.alertIdentifier String The alert identifier the Involved Entity belongs to.
GoogleSecOps.AlertEntity.environment String The environment of the Involved Entity.
GoogleSecOps.AlertEntity.threatSource String The threat source associated with the Involved Entity.
GoogleSecOps.AlertEntity.operatingSystem String The operating system of the Involved Entity.
GoogleSecOps.AlertEntity.networkTitle String The network name related to the Involved Entity.
GoogleSecOps.AlertEntity.networkPriority Number The network priority of the Involved Entity.
GoogleSecOps.AlertEntity.entityUri String The full URL of the Involved Entity in the source system.
GoogleSecOps.AlertEntity.sourceSystemUri String The source system URI link of the Involved Entity.
GoogleSecOps.AlertEntity.additionalProperties String The additional properties of the Involved Entity as a JSON string.
GoogleSecOps.AlertEntity.suspicious Boolean Whether the Involved Entity is considered suspicious.
GoogleSecOps.AlertEntity.internal Boolean Whether the Involved Entity is internal.
GoogleSecOps.AlertEntity.attacker Boolean Whether the Involved Entity represents an attacker.
GoogleSecOps.AlertEntity.pivot Boolean Whether the Involved Entity is a pivot entity common to multiple cases.
GoogleSecOps.AlertEntity.manuallyCreated Boolean Whether the Involved Entity was added manually.
GoogleSecOps.AlertEntity.enriched Boolean Whether the Involved Entity has been enriched by an external action.
GoogleSecOps.AlertEntity.artifact Boolean Whether the Involved Entity is an artifact.
GoogleSecOps.AlertEntity.vulnerable Boolean Whether the Involved Entity is vulnerable.
GoogleSecOps.AlertEntity.fields.displayName String The display name of the context group of the Involved Entity.
GoogleSecOps.AlertEntity.fields.highlighted Boolean Whether the context group of the Involved Entity is highlighted.
GoogleSecOps.AlertEntity.fields.hidden Boolean Whether the context group of the Involved Entity is hidden.
GoogleSecOps.AlertEntity.fields.items.name String The property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.originalName String The original property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.value String The value of the context group item of the Involved Entity.

Command example

!gcb-case-alert-entity-update case_id=306082 alert_id=1001 entity_id=376398 suspicious=true attacker=true network_priority=5

Context Example

{
    "GoogleSecOps": {
        "AlertEntity": {
            "id": "376398",
            "type": "ADDRESS",
            "suspicious": true,
            "internal": false,
            "networkPriority": 5,
            "attacker": true,
            "pivot": false,
            "environment": "Default Environment",
            "manuallyCreated": true,
            "additionalProperties": "{\"Type\":\"ADDRESS\",\"IsArtifact\":\"False\",\"IsEnriched\":\"False\",\"IsVulnerable\":\"False\",\"IsInternalAsset\":\"False\",\"OriginalIdentifier\":\"192.0.2.1\"}",
            "enriched": false,
            "artifact": false,
            "vulnerable": false,
            "fields": [
                {
                    "displayName": "Default",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {
                            "name": "Network_Priority",
                            "originalName": "Network_Priority",
                            "value": "5"
                        },
                        {
                            "name": "IsSuspicious",
                            "originalName": "IsSuspicious",
                            "value": "True"
                        },
                        {
                            "name": "IsAttacker",
                            "originalName": "IsAttacker",
                            "value": "True"
                        },
                        {
                            "name": "IsManuallyCreated",
                            "originalName": "IsManuallyCreated",
                            "value": "True"
                        },
                        {
                            "name": "Environment",
                            "originalName": "Environment",
                            "value": "Default Environment"
                        },
                        {
                            "name": "Alert_Id",
                            "originalName": "Alert_Id",
                            "value": "Testing Alert_00000000-0000-0000-0000-000000000001"
                        }
                    ]
                },
                {
                    "displayName": "Entity",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {
                            "name": "Is Pivot",
                            "originalName": "IsPivot",
                            "value": "False"
                        }
                    ]
                }
            ],
            "alertIdentifier": "Testing Alert_00000000-0000-0000-0000-000000000001",
            "caseId": 306082,
            "alertId": "1001",
            "identifier": "192.0.2.1"
        }
    }
}

Human Readable Output

Updated Entity Information

ID Identifier Alert ID Case ID Alert Identifier Type Environment Suspicious Internal Attacker Pivot Enriched Artifact Vulnerable Manually Created Network Priority Additional Properties Fields
376398 192.0.2.1 1001 306082 Testing Alert_00000000-0000-0000-0000-000000000001 ADDRESS Default Environment True False True False False False False True 5 {“Type”:”ADDRESS”,”IsArtifact”:”False”,”IsEnriched”:”False”,”IsVulnerable”:”False”,”IsInternalAsset”:”False”,”OriginalIdentifier”:”192.0.2.1”} - displayName: Default
highlighted: False
hidden: False
items:
- name: Network_Priority
originalName: Network_Priority
value: 5
- name: IsSuspicious
originalName: IsSuspicious
value: True
- name: IsAttacker
originalName: IsAttacker
value: True
- name: IsManuallyCreated
originalName: IsManuallyCreated
value: True
- name: Environment
originalName: Environment
value: Default Environment
- name: Alert_Id
originalName: Alert_Id
value: Testing Alert_00000000-0000-0000-0000-000000000001
- displayName: Entity
highlighted: False
hidden: False
items:
- name: Is Pivot
originalName: IsPivot
value: False

gcb-case-alert-entity-property-add

Add a new custom property to an involved entity in a case alert.

Base Command

gcb-case-alert-entity-property-add

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
entity_id Specify the ID of the involved entity to add a property.

Note: Use gcb-case-alert-entity-list to retrieve entity ID.		 Required
key Specify the property key to add.

Note: The key must not already exist on the entity.		 Required
value Specify the value for the new property. Required

Context Output

Path Type Description
GoogleSecOps.AlertEntity.id String The immutable identifier of the Involved Entity.
GoogleSecOps.AlertEntity.identifier String The identifier name of the Involved Entity.
GoogleSecOps.AlertEntity.type String The type of the Involved Entity.
GoogleSecOps.AlertEntity.alertId String The Alert ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.caseId Number The Case ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.alertIdentifier String The alert identifier the Involved Entity belongs to.
GoogleSecOps.AlertEntity.environment String The environment of the Involved Entity.
GoogleSecOps.AlertEntity.threatSource String The threat source associated with the Involved Entity.
GoogleSecOps.AlertEntity.operatingSystem String The operating system of the Involved Entity.
GoogleSecOps.AlertEntity.networkTitle String The network name related to the Involved Entity.
GoogleSecOps.AlertEntity.networkPriority Number The network priority of the Involved Entity.
GoogleSecOps.AlertEntity.entityUri String The full URL of the Involved Entity in the source system.
GoogleSecOps.AlertEntity.sourceSystemUri String The source system URI link of the Involved Entity.
GoogleSecOps.AlertEntity.additionalProperties String The additional properties of the Involved Entity as a JSON string.
GoogleSecOps.AlertEntity.suspicious Boolean Whether the Involved Entity is considered suspicious.
GoogleSecOps.AlertEntity.internal Boolean Whether the Involved Entity is internal.
GoogleSecOps.AlertEntity.attacker Boolean Whether the Involved Entity represents an attacker.
GoogleSecOps.AlertEntity.pivot Boolean Whether the Involved Entity is a pivot entity common to multiple cases.
GoogleSecOps.AlertEntity.manuallyCreated Boolean Whether the Involved Entity was added manually.
GoogleSecOps.AlertEntity.enriched Boolean Whether the Involved Entity has been enriched by an external action.
GoogleSecOps.AlertEntity.artifact Boolean Whether the Involved Entity is an artifact.
GoogleSecOps.AlertEntity.vulnerable Boolean Whether the Involved Entity is vulnerable.
GoogleSecOps.AlertEntity.fields.displayName String The display name of the context group of the Involved Entity.
GoogleSecOps.AlertEntity.fields.highlighted Boolean Whether the context group of the Involved Entity is highlighted.
GoogleSecOps.AlertEntity.fields.hidden Boolean Whether the context group of the Involved Entity is hidden.
GoogleSecOps.AlertEntity.fields.items.name String The property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.originalName String The original property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.value String The value of the context group item of the Involved Entity.

Command example

!gcb-case-alert-entity-property-add case_id=306082 alert_id=1001 entity_id=376398 key=total_score value=42/72

Context Example

{
    "GoogleSecOps": {
        "AlertEntity": {
            "id": "376398",
            "type": "ADDRESS",
            "suspicious": true,
            "internal": false,
            "networkPriority": 5,
            "attacker": true,
            "pivot": false,
            "environment": "Default Environment",
            "manuallyCreated": true,
            "additionalProperties": "{\"Type\":\"ADDRESS\",\"IsArtifact\":\"False\",\"IsEnriched\":\"False\",\"IsVulnerable\":\"False\",\"IsInternalAsset\":\"False\",\"OriginalIdentifier\":\"192.0.2.1\"}",
            "enriched": true,
            "artifact": false,
            "vulnerable": false,
            "fields": [
                {
                    "displayName": "Default",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {"name": "Network_Priority", "originalName": "Network_Priority", "value": "5"},
                        {"name": "IsSuspicious", "originalName": "IsSuspicious", "value": "True"},
                        {"name": "IsAttacker", "originalName": "IsAttacker", "value": "True"},
                        {"name": "IsManuallyCreated", "originalName": "IsManuallyCreated", "value": "True"},
                        {"name": "Environment", "originalName": "Environment", "value": "Default Environment"},
                        {"name": "Alert_Id", "originalName": "Alert_Id", "value": "Testing Alert_00000000-0000-0000-0000-000000000001"}
                    ]
                },
                {
                    "displayName": "Entity",
                    "highlighted": false,
                    "hidden": false,
                    "items": [{"name": "Is Pivot", "originalName": "IsPivot", "value": "False"}]
                },
                {
                    "displayName": "Enrichment",
                    "highlighted": false,
                    "hidden": false,
                    "items": [{"name": "Total Score", "originalName": "Total Score", "value": "42/72"}]
                }
            ],
            "alertIdentifier": "Testing Alert_00000000-0000-0000-0000-000000000001",
            "caseId": 306082,
            "alertId": "1001",
            "identifier": "192.0.2.1"
        }
    }
}

Human Readable Output

Added Entity Property with key total_score and value 42/72.

gcb-case-alert-entity-property-update

Update an existing custom property value on an involved entity in a case alert.

Base Command

gcb-case-alert-entity-property-update

Input

Argument Name Description Required
case_id Specify the ID of the case.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_id Specify the ID of the case alert.

Note: Use gcb-case-alert-list to retrieve alert ID.		 Required
entity_id Specify the ID of the involved entity to update the property.

Note: Use gcb-case-alert-entity-list to retrieve entity ID.		 Required
key Specify the existing property key whose value should be updated. Required
value Specify the new value for the property. Required

Context Output

Path Type Description
GoogleSecOps.AlertEntity.id String The immutable identifier of the Involved Entity.
GoogleSecOps.AlertEntity.identifier String The identifier name of the Involved Entity.
GoogleSecOps.AlertEntity.type String The type of the Involved Entity.
GoogleSecOps.AlertEntity.alertId String The Alert ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.caseId Number The Case ID the Involved Entity belongs to.
GoogleSecOps.AlertEntity.alertIdentifier String The alert identifier the Involved Entity belongs to.
GoogleSecOps.AlertEntity.environment String The environment of the Involved Entity.
GoogleSecOps.AlertEntity.threatSource String The threat source associated with the Involved Entity.
GoogleSecOps.AlertEntity.operatingSystem String The operating system of the Involved Entity.
GoogleSecOps.AlertEntity.networkTitle String The network name related to the Involved Entity.
GoogleSecOps.AlertEntity.networkPriority Number The network priority of the Involved Entity.
GoogleSecOps.AlertEntity.entityUri String The full URL of the Involved Entity in the source system.
GoogleSecOps.AlertEntity.sourceSystemUri String The source system URI link of the Involved Entity.
GoogleSecOps.AlertEntity.additionalProperties String The additional properties of the Involved Entity as a JSON string.
GoogleSecOps.AlertEntity.suspicious Boolean Whether the Involved Entity is considered suspicious.
GoogleSecOps.AlertEntity.internal Boolean Whether the Involved Entity is internal.
GoogleSecOps.AlertEntity.attacker Boolean Whether the Involved Entity represents an attacker.
GoogleSecOps.AlertEntity.pivot Boolean Whether the Involved Entity is a pivot entity common to multiple cases.
GoogleSecOps.AlertEntity.manuallyCreated Boolean Whether the Involved Entity was added manually.
GoogleSecOps.AlertEntity.enriched Boolean Whether the Involved Entity has been enriched by an external action.
GoogleSecOps.AlertEntity.artifact Boolean Whether the Involved Entity is an artifact.
GoogleSecOps.AlertEntity.vulnerable Boolean Whether the Involved Entity is vulnerable.
GoogleSecOps.AlertEntity.fields.displayName String The display name of the context group of the Involved Entity.
GoogleSecOps.AlertEntity.fields.highlighted Boolean Whether the context group of the Involved Entity is highlighted.
GoogleSecOps.AlertEntity.fields.hidden Boolean Whether the context group of the Involved Entity is hidden.
GoogleSecOps.AlertEntity.fields.items.name String The property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.originalName String The original property name of the context group item of the Involved Entity.
GoogleSecOps.AlertEntity.fields.items.value String The value of the context group item of the Involved Entity.

Command example

!gcb-case-alert-entity-property-update case_id=306082 alert_id=1001 entity_id=376398 key=total_score value=68/72

Context Example

{
    "GoogleSecOps": {
        "AlertEntity": {
            "id": "376398",
            "type": "ADDRESS",
            "suspicious": true,
            "internal": false,
            "networkPriority": 5,
            "attacker": true,
            "pivot": false,
            "environment": "Default Environment",
            "manuallyCreated": true,
            "additionalProperties": "{\"Type\":\"ADDRESS\",\"IsArtifact\":\"False\",\"IsEnriched\":\"False\",\"IsVulnerable\":\"False\",\"IsInternalAsset\":\"False\",\"OriginalIdentifier\":\"192.0.2.1\"}",
            "enriched": true,
            "artifact": false,
            "vulnerable": false,
            "fields": [
                {
                    "displayName": "Default",
                    "highlighted": false,
                    "hidden": false,
                    "items": [
                        {"name": "Network_Priority", "originalName": "Network_Priority", "value": "5"},
                        {"name": "IsSuspicious", "originalName": "IsSuspicious", "value": "True"},
                        {"name": "IsAttacker", "originalName": "IsAttacker", "value": "True"},
                        {"name": "IsManuallyCreated", "originalName": "IsManuallyCreated", "value": "True"},
                        {"name": "Environment", "originalName": "Environment", "value": "Default Environment"},
                        {"name": "Alert_Id", "originalName": "Alert_Id", "value": "Testing Alert_00000000-0000-0000-0000-000000000001"}
                    ]
                },
                {
                    "displayName": "Entity",
                    "highlighted": false,
                    "hidden": false,
                    "items": [{"name": "Is Pivot", "originalName": "IsPivot", "value": "False"}]
                },
                {
                    "displayName": "Enrichment",
                    "highlighted": false,
                    "hidden": false,
                    "items": [{"name": "Total Score", "originalName": "Total Score", "value": "68/72"}]
                }
            ],
            "alertIdentifier": "Testing Alert_00000000-0000-0000-0000-000000000001",
            "caseId": 306082,
            "alertId": "1001",
            "identifier": "192.0.2.1"
        }
    }
}

Human Readable Output

Updated Entity Property with key total_score and value 68/72.

gcb-playbook-list

Retrieve the list of all playbooks that are currently enabled and ready for execution.

Base Command

gcb-playbook-list

Input

Argument Name Description Required
environment Filter the playbooks by environment. Optional
execution_scope Filter the playbooks attachable by the specified execution scope. Possible values are: ALERT, CASE, EXECUTION_SCOPE_UNSPECIFIED. Default is ALERT. Optional

Context Output

Path Type Description
GoogleSecOps.Playbook.playbookName String The name of the enabled playbook.
GoogleSecOps.Playbook.description String The description of the playbook.
GoogleSecOps.Playbook.playbookType String The type of the playbook (REGULAR or NESTED).
GoogleSecOps.Playbook.originalWorkflowDefinitionIdentifier String The original workflow definition identifier of the playbook.
GoogleSecOps.Playbook.workflowDefinitionIdentifier String The workflow definition identifier of the playbook.
GoogleSecOps.Playbook.isDebugMode Boolean Whether the playbook is running in debug mode.

Command example

!gcb-playbook-list execution_scope=ALERT

Context Example

{
    "GoogleSecOps": {
        "Playbook": [
            {
                "playbookName": "IMPORT 5 - Network Containment Block - Google",
                "description": "Automated IP containment playbook that queries Google using CVE identifiers, extracts malicious IPs, creates entities in alerts, and blocks them via Zscaler. Supports real-time threat intelligence-based network containment.",
                "playbookType": "NESTED",
                "isDebugMode": true,
                "originalWorkflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000001",
                "workflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000001"
            },
            {
                "playbookName": "Google Cloud Compute Platform Starting Playbook",
                "description": "Google Cloud Compute Platform Starting Playbook provides reference implementation of how Google Cloud Compute Platform alerts can be processed in Google SecOps.",
                "playbookType": "REGULAR",
                "isDebugMode": false,
                "originalWorkflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000002",
                "workflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000002"
            },
            {
                "playbookName": "Set Initial Severity",
                "description": "An embedded workflow that can receive inputs and return an output.",
                "playbookType": "NESTED",
                "isDebugMode": true,
                "originalWorkflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000003",
                "workflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000003"
            },
            {
                "playbookName": "Google - Network Containment Block",
                "description": "Automated IP containment playbook that queries Google using CVE identifiers, extracts malicious IPs, creates entities in alerts, and blocks them via Zscaler. Supports real-time threat intelligence-based network containment.",
                "playbookType": "NESTED",
                "isDebugMode": false,
                "originalWorkflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000004",
                "workflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000005"
            }
        ]
    }
}

Human Readable Output

Enabled Playbooks

Playbook Name Description Playbook Type Original Workflow Definition Identifier Workflow Definition Identifier Is Debug Mode
IMPORT 5 - Network Containment Block - Google Automated IP containment playbook that queries Google using CVE identifiers, extracts malicious IPs, creates entities in alerts, and blocks them via Zscaler. Supports real-time threat intelligence-based network containment. NESTED 00000000-0000-0000-0000-000000000001 00000000-0000-0000-0000-000000000001 True
Google Cloud Compute Platform Starting Playbook Google Cloud Compute Platform Starting Playbook provides reference implementation of how Google Cloud Compute Platform alerts can be processed in Google SecOps. REGULAR 00000000-0000-0000-0000-000000000002 00000000-0000-0000-0000-000000000002 False
Set Initial Severity An embedded workflow that can receive inputs and return an output. NESTED 00000000-0000-0000-0000-000000000003 00000000-0000-0000-0000-000000000003 True
Google - Network Containment Block Automated IP containment playbook that queries Google using CVE identifiers, extracts malicious IPs, creates entities in alerts, and blocks them via Zscaler. Supports real-time threat intelligence-based network containment. NESTED 00000000-0000-0000-0000-000000000004 00000000-0000-0000-0000-000000000005 False

gcb-playbook-attach

Manually attach (trigger) a specific playbook to a case alert.

Base Command

gcb-playbook-attach

Input

Argument Name Description Required
case_id Specify the ID of the case to attach the playbook.

Note: Use gcb-case-list to retrieve case ID.		 Required
alert_group_identifier Specify the alert group identifier of the case alert.

Note: Use gcb-case-alert-get to retrieve the alert group identifier.		 Required
alert_identifier Specify the alert identifier of the case alert.

Note: Use gcb-case-alert-get to retrieve the alert identifier.		 Required
playbook_name Specify the name of the playbook (workflow) to attach.

Note: Use gcb-playbook-list to retrieve available playbook names.		 Required
original_workflow_definition_identifier Specify the original workflow definition identifier of the playbook.

Note: Use gcb-playbook-list to retrieve the original workflow definition identifier.		 Optional

Context Output

Path Type Description
GoogleSecOps.PlaybookAttach.caseId String The Case ID the playbook was attached to.
GoogleSecOps.PlaybookAttach.alertGroupIdentifier String The alert group identifier the playbook was attached to.
GoogleSecOps.PlaybookAttach.alertIdentifier String The alert identifier the playbook was attached to.
GoogleSecOps.PlaybookAttach.playbookName String The name of the playbook that was attached.
GoogleSecOps.PlaybookAttach.originalWorkflowDefinitionIdentifier String The original workflow definition identifier of the attached playbook.
GoogleSecOps.PlaybookAttach.success Boolean Whether the playbook was successfully attached to the alert.

Command example

!gcb-playbook-attach case_id=1001 alert_group_identifier="Access Disabled Accounts_00000000-0000-0000-0000-000000000001" alert_identifier="ACCESS DISABLED ACCOUNTS_00000000-0000-0000-0000-000000000002" playbook_name="Phishing Investigation" original_workflow_definition_identifier="00000000-0000-0000-0000-000000000001"

Context Example

{
    "GoogleSecOps": {
        "PlaybookAttach": {
            "caseId": "1001",
            "alertGroupIdentifier": "Access Disabled Accounts_00000000-0000-0000-0000-000000000001",
            "alertIdentifier": "ACCESS DISABLED ACCOUNTS_00000000-0000-0000-0000-000000000002",
            "playbookName": "Phishing Investigation",
            "originalWorkflowDefinitionIdentifier": "00000000-0000-0000-0000-000000000001",
            "success": true
        }
    }
}

Human Readable Output

Playbook ‘Phishing Investigation’ successfully attached to alert ACCESS DISABLED ACCOUNTS_00000000-0000-0000-0000-000000000002 in case 1001.

Configuration parameters

  • credentials — (required)
  • url_format — API URL Format
  • secops_project_instance_id — Google SecOps Project Instance ID (required)
  • secops_project_number — Google SecOps Project Number
  • region — Region (required)
  • other_region — Other Region
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First Fetch Time
  • max_fetch — How many incidents to fetch each time
  • case_priorities — Case Priorities
  • case_statuses — Case Statuses
  • case_environments — Case Environments
  • case_tags — Case Tags
  • case_filter_logic — Case Filter Logic
  • incidentFetchInterval — Incidents Fetch Interval
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (36)

  • gcb-case-alert-customfield-list

    Retrieve the list of custom field values associated with a case alert.

  • gcb-case-alert-entity-create

    Manually create a new involved entity within a case alert.

  • gcb-case-alert-entity-get

    Retrieve detailed information about a specific involved entity in a case alert.

  • gcb-case-alert-entity-list

    Retrieve the list of entities associated with a case alert.

  • gcb-case-alert-entity-property-add

    Add a new custom property to an involved entity in a case alert.

  • gcb-case-alert-entity-property-update

    Update an existing custom property value on an involved entity in a case alert.

  • gcb-case-alert-entity-update

    Update the attributes of an existing involved entity in a case alert.

  • gcb-case-alert-get

    Retrieve detailed information about a specific case alert by its ID.

  • gcb-case-alert-list

    Retrieve the list of alerts associated with the specified case.

  • gcb-case-alert-move

    Move a case alert to a different case. Note: Both source and destination cases must be open.

  • gcb-case-alert-recommendation-create

    Initiate an asynchronous AI recommendation for a case alert.

  • gcb-case-alert-recommendation-fetch

    Fetch a previously generated AI recommendation for a case alert.

  • gcb-case-alert-sla-pause

    Pause the SLA timer for the specified case alert.

  • gcb-case-alert-sla-resume

    Resume the SLA timer for the specified case alert.

  • gcb-case-alert-sla-set

    Set the SLA parameters for a case alert. Note: When critical_time is specified, total_time must be greater than critical_time.

  • gcb-case-alert-tag-add

    Add a tag to a case alert.

  • gcb-case-alert-tag-remove

    Remove a tag from a case alert.

  • gcb-case-alert-update

    Update the properties of an existing case alert.

  • gcb-case-assign

    Assign the specified cases to a specific analyst or SOC role.

  • gcb-case-close

    Close the specified cases.

  • gcb-case-close-definition-list

    Retrieve the list of case close definitions configured in the instance.

  • gcb-case-comment-create

    Add a comment to the specified case.

  • gcb-case-comment-list

    Retrieve the list of comments associated with the specified case.

  • gcb-case-get

    Retrieve a specific case by its ID.

  • gcb-case-list

    Retrieve the list of cases.

  • gcb-case-priority-change

    Change the priority of the specified cases.

  • gcb-case-reopen

    Reopen the specified cases.

  • gcb-case-sla-pause

    Pause the SLA timer for the specified case.

  • gcb-case-sla-resume

    Resume the SLA timer for the specified case.

  • gcb-case-stage-change

    Change the workflow stage of the specified cases.

  • gcb-case-stage-definition-list

    Retrieve the list of case stage definitions configured in the instance.

  • gcb-case-tag-add

    Add the specified tags to the cases.

  • gcb-case-tag-remove

    Remove the specified tag from a case.

  • gcb-case-update

    Update the properties of a case.

  • gcb-playbook-attach

    Manually attach (trigger) a specific playbook to a case alert.

  • gcb-playbook-list

    Retrieve the list of all playbooks that are currently enabled and ready for execution.

Source

GoogleSecOpsCases.py GoogleSecOpsCases_test.py GoogleSecOpsCases.yml GoogleSecOpsCases_description.md
Download History Raw 
category: Analytics & SIEM
commonfields:
  id: GoogleSecOpsCases
  version: -1
provider: Google
sectionorder:
- Connect
- Collect
configuration:
- displaypassword: User's Service Account JSON
  name: credentials
  hiddenusername: true
  required: true
  type: 9
  section: Connect
- display: API URL Format
  additionalinfo: "Select the API URL format to use for API requests. Default value is '<chronicle>.<REGION>.<rep.googleapis.com>'."
  name: url_format
  required: false
  type: 15
  options:
  - "<REGION>-<chronicle.googleapis.com>"
  - "<chronicle>.<REGION>.<rep.googleapis.com>"
  section: Connect
- display: Google SecOps Project Instance ID
  additionalinfo: "Provide the Project Instance ID of the Google SecOps.\n\nNote: User can retrieve the Customer ID(Project Instance ID) in the Profile section of the Google SecOps page."
  name: secops_project_instance_id
  required: true
  type: 0
  section: Connect
- display: Google SecOps Project Number
  additionalinfo: "Provide the Project Number of the Google SecOps.\n\nNote: User can retrieve the Project Number in the Profile section of the Google SecOps page. If Project Number is not provided, then Project ID(from Service Account JSON) will be used."
  name: secops_project_number
  required: false
  type: 0
  section: Connect
- additionalinfo: Select the region based on the location of the Google SecOps instance. If the region is not listed in the dropdown, choose the "Other" option and specify the region in the "Other Region" text field.
  defaultvalue: US
  display: Region
  name: region
  required: true
  options:
  - Africa-south1
  - Asia-northeast1
  - Asia-south1
  - Asia-southeast1
  - Asia-southeast2
  - Australia-southeast1
  - EU
  - Europe-west2
  - Europe-west3
  - Europe-west6
  - Europe-west9
  - Europe-west12
  - ME-central1
  - ME-central2
  - ME-west1
  - Northamerica-northeast2
  - Southamerica-east1
  - US
  - Other
  type: 15
  section: Connect
- additionalinfo: Specify the region based on the location of the Google SecOps instance. Only applicable if the "Other" option is selected in the Region dropdown.
  display: Other Region
  hidden: false
  name: other_region
  required: false
  type: 0
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
- display: Incident type
  defaultvalue: Google SecOps Case
  name: incidentType
  type: 13
  section: Connect
  required: false
- additionalinfo: |-
    The UTC date or relative timestamp from where to start fetching incidents. Default is 3 days.

    Note: If the value is greater than the past 7 days, it will be considered as past 7 days. The maximum is 7 days.

    Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

    For example: 01 May 2026, 01 May 2026 04:45:33, 2026-05-17T14:05:44Z.
  defaultvalue: 3 days
  display: First Fetch Time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: |-
    The maximum number of incidents to fetch in each time. Default is 50.

    Note: If the value is greater than 200, it will be considered as 200. The maximum is 200.
  defaultvalue: '50'
  display: How many incidents to fetch each time
  name: max_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: Filter cases by priority level. Default is all.
  display: Case Priorities
  name: case_priorities
  options:
  - UNSPECIFIED
  - INFO
  - LOW
  - MEDIUM
  - HIGH
  - CRITICAL
  type: 16
  section: Collect
  required: false
- additionalinfo: Filter cases by status. Default is all.
  display: Case Statuses
  name: case_statuses
  options:
  - CASE_DATA_STATE_UNSPECIFIED
  - OPENED
  - CLOSED
  - MERGED
  - CREATION_PENDING
  type: 16
  section: Collect
  required: false
- additionalinfo: Filter cases by logical environment.
  display: Case Environments
  name: case_environments
  type: 16
  section: Collect
  required: false
- additionalinfo: Filter cases by tag name.
  display: Case Tags
  name: case_tags
  type: 16
  section: Collect
  required: false
- additionalinfo: Logical operator to combine the case filter parameters. Default is AND.
  defaultvalue: AND
  display: Case Filter Logic
  name: case_filter_logic
  type: 15
  options:
  - AND
  - OR
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Use the Google SecOps Cases integration to retrieve Cases as Incidents. This integration also provides commands to manage the Cases lifecycle.
display: Google SecOps Cases
name: GoogleSecOpsCases
script:
  commands:
  - arguments:
    - description: "Filter the cases by display name. Supports comma-separated values."
      isArray: true
      name: display_name
    - auto: PREDEFINED
      description: "Filter the cases by priority. Supports comma-separated values."
      isArray: true
      name: priority
      predefined:
      - UNSPECIFIED
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    - auto: PREDEFINED
      description: "Filter the cases by status. Supports comma-separated values."
      isArray: true
      name: status
      predefined:
      - OPENED
      - CLOSED
      - MERGED
      - CREATION_PENDING
      - CASE_DATA_STATE_UNSPECIFIED
    - auto: PREDEFINED
      description: "Filter the cases by type. Supports comma-separated values."
      isArray: true
      name: type
      predefined:
      - EXTERNAL
      - TEST
      - REQUEST
      - CASE_TYPE_UNSPECIFIED
    - auto: PREDEFINED
      description: "Filter the cases by stage. Supports comma-separated values."
      isArray: true
      name: stage
      predefined:
      - Triage
      - Incident
      - Investigation
    - auto: PREDEFINED
      description: "Filter the cases by source. Supports comma-separated values."
      isArray: true
      name: source
      predefined:
      - Server
      - User
      - Simulated
      - Merge
      - AlertMove
    - description: "Filter the cases by assignee user email or SOC role. Supports comma-separated values."
      isArray: true
      name: assignee
    - description: "Filter the cases by environment assigned to the case. Supports comma-separated values."
      isArray: true
      name: environment
    - description: "Filter the cases by tag names. Supports comma-separated values."
      isArray: true
      name: tags
    - description: "Filter the cases by product name. Supports comma-separated values."
      isArray: true
      name: products
    - auto: PREDEFINED
      description: "Filter the cases by the importance flag."
      name: important
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: "Filter the cases by the incident flag."
      name: incident
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: "Filter the cases by playbook or workflow execution status. Supports comma-separated values."
      isArray: true
      name: workflow_status
      predefined:
      - NONE
      - IN_PROGRESS
      - COMPLETED
      - FAILED
      - TERMINATED
      - PENDING_IN_QUEUE
      - PENDING_FOR_USER
      - WORKFLOW_STATUS_UNSPECIFIED
    - auto: PREDEFINED
      description: "Filter the cases by SLA expiration status. Supports comma-separated values."
      isArray: true
      name: sla
      predefined:
      - OPEN_SLA
      - PASSED_DUE
      - NO_SLA
      - CRITICAL_EXPIRED
      - PAUSED
      - SLA_EXPIRATION_STATUS_UNSPECIFIED
    - auto: PREDEFINED
      description: "Filter the cases by the aggregated alerts SLA expiration status. Supports comma-separated values."
      isArray: true
      name: alerts_sla
      predefined:
      - OPEN_SLA
      - PASSED_DUE
      - NO_SLA
      - CRITICAL_EXPIRED
      - PAUSED
      - SLA_EXPIRATION_STATUS_UNSPECIFIED
    - description: "Filter the cases created on or after this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: create_start_time
    - description: "Filter the cases created on or before this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: create_end_time
    - description: "Filter the cases updated on or after this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: update_start_time
    - description: "Filter the cases updated on or before this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: update_end_time
    - description: "Specify a raw AIP-160 filter string for advanced conditions. When provided, all other individual filter arguments are ignored.\n\nSupported values: displayName, creatorUserId, creatorUser, assignee, stage, status, priority, important, type, environment, score, alertsSla.expirationStatus, sla.expirationStatus, tags, products, closureDetails, tasks, workflowStatus, createTime, updateTime\n\nExample: (priority=\"PRIORITY_HIGH\" OR status=\"OPENED\") AND stage=\"Investigation\"."
      name: advanced_filter
    - defaultValue: '50'
      description: "Specify the maximum number of cases to return.\n\nNote: Maximum value is 1000."
      name: page_size
    - description: "Specify the page token for pagination.\n\nNote: Use the next_page_token from a previous gcb-case-list response."
      name: page_token
    - auto: PREDEFINED
      defaultValue: createTime
      description: "Specify the field to sort results by."
      name: sort_by
      predefined:
      - displayName
      - priority
      - stage
      - status
      - score
      - createTime
      - updateTime
      - assignee
      - environment
      - type
      - sla.expirationTime
      - alertsSla.expirationTime
      - sla.expirationStatus
      - alertsSla.expirationStatus
      - workflowStatus
    - auto: PREDEFINED
      defaultValue: Desc
      description: "Specify the sort direction for the results."
      name: sort_order
      predefined:
      - Asc
      - Desc
    - auto: PREDEFINED
      defaultValue: AND
      description: "Specify the logical operator to combine filter conditions."
      name: filter_logic
      predefined:
      - AND
      - OR
    description: Retrieve the list of cases.
    name: gcb-case-list
    outputs:
    - contextPath: GoogleSecOps.Case.name
      description: The unique resource name of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.displayName
      description: The title of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.creatorUserId
      description: The ID of the user who created the Case.
      type: String
    - contextPath: GoogleSecOps.Case.lastModifyingUserId
      description: The ID of the user who last modified the Case.
      type: String
    - contextPath: GoogleSecOps.Case.createTime
      description: The creation time of the Case (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.updateTime
      description: The last update time of the Case (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.alertCount
      description: The number of alerts linked to the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.stage
      description: The current workflow stage of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.priority
      description: The priority of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.assignee
      description: The assigned user or SOC role of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.description
      description: The description of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.type
      description: The type of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.environment
      description: The logical environment of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.status
      description: The status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.score
      description: The attack exposure score of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.workflowStatus
      description: The playbook or workflow status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.source
      description: The source that created the Case.
      type: String
    - contextPath: GoogleSecOps.Case.important
      description: Whether the Case is marked as important.
      type: Boolean
    - contextPath: GoogleSecOps.Case.incident
      description: Whether the Case is marked as an incident.
      type: Boolean
    - contextPath: GoogleSecOps.Case.overflowCase
      description: Whether the Case is an overflow case due to large data volume.
      type: Boolean
    - contextPath: GoogleSecOps.Case.involvedSuspiciousEntity
      description: Whether a suspicious entity is involved in the Case.
      type: Boolean
    - contextPath: GoogleSecOps.Case.sla.expirationTime
      description: The SLA expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.sla.criticalExpirationTime
      description: The SLA critical expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.sla.expirationStatus
      description: The SLA expiration status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.sla.remainingTimeSinceLastPause
      description: The remaining time since the last SLA pause of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.alertsSla.expirationTime
      description: The aggregated alerts SLA expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.criticalExpirationTime
      description: The aggregated alerts SLA critical expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.expirationStatus
      description: The aggregated alerts SLA expiration status.
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.remainingTimeSinceLastPause
      description: The remaining time since the last alerts SLA pause of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.tags.displayName
      description: The display name of the tag.
      type: String
    - contextPath: GoogleSecOps.Case.tags.priority
      description: The priority order of the tag.
      type: Number
    - contextPath: GoogleSecOps.Case.products.displayName
      description: The display name of the product.
      type: String
    - contextPath: GoogleSecOps.Case.products.alert
      description: The resource name of the alert associated with the product.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.id
      description: The ID of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.title
      description: The title of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.content
      description: The content/description of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.status
      description: The status of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.assignee
      description: The assignee of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.author
      description: The author who created the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.lastAuthor
      description: The last user who modified the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.createTime
      description: The creation time of the task (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.tasks.updateTime
      description: The last update time of the task (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.tasks.caseId
      description: The ID of the Case the task belongs to.
      type: Number
    - contextPath: GoogleSecOps.Case.tasks.favorite
      description: Whether the task is marked as a favorite.
      type: Boolean
    - contextPath: GoogleSecOps.Case.closureDetails.reason
      description: The closure reason of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.comment
      description: The closure comment of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.rootCause
      description: The root cause provided at closure.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.caseClosedAction
      description: The action taken when the Case was closed.
      type: String
    - contextPath: GoogleSecOps.PageToken.command
      description: The command name associated with the pagination token.
      type: String
    - contextPath: GoogleSecOps.PageToken.nextPageToken
      description: The token to retrieve the next page of Cases.
      type: String
    - contextPath: GoogleSecOps.PageToken.totalSize
      description: The total number of cases available.
      type: Number
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    description: Retrieve a specific case by its ID.
    name: gcb-case-get
    outputs:
    - contextPath: GoogleSecOps.Case.name
      description: The unique resource name of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.displayName
      description: The title of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.creatorUserId
      description: The ID of the user who created the Case.
      type: String
    - contextPath: GoogleSecOps.Case.lastModifyingUserId
      description: The ID of the user who last modified the Case.
      type: String
    - contextPath: GoogleSecOps.Case.createTime
      description: The creation time of the Case (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.updateTime
      description: The last update time of the Case (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.alertCount
      description: The number of alerts linked to the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.stage
      description: The current workflow stage of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.priority
      description: The priority of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.assignee
      description: The assigned user or SOC role of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.description
      description: The description of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.type
      description: The type of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.environment
      description: The logical environment of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.status
      description: The status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.score
      description: The attack exposure score of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.workflowStatus
      description: The playbook or workflow status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.source
      description: The source that created the Case.
      type: String
    - contextPath: GoogleSecOps.Case.important
      description: Whether the Case is marked as important.
      type: Boolean
    - contextPath: GoogleSecOps.Case.incident
      description: Whether the Case is marked as an incident.
      type: Boolean
    - contextPath: GoogleSecOps.Case.overflowCase
      description: Whether the Case is an overflow case due to large data volume.
      type: Boolean
    - contextPath: GoogleSecOps.Case.involvedSuspiciousEntity
      description: Whether a suspicious entity is involved in the Case.
      type: Boolean
    - contextPath: GoogleSecOps.Case.sla.expirationTime
      description: The SLA expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.sla.criticalExpirationTime
      description: The SLA critical expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.sla.expirationStatus
      description: The SLA expiration status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.sla.remainingTimeSinceLastPause
      description: The remaining time since the last SLA pause of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.alertsSla.expirationTime
      description: The aggregated alerts SLA expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.criticalExpirationTime
      description: The aggregated alerts SLA critical expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.expirationStatus
      description: The aggregated alerts SLA expiration status.
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.remainingTimeSinceLastPause
      description: The remaining time since the last alerts SLA pause of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.tags.displayName
      description: The display name of the tag.
      type: String
    - contextPath: GoogleSecOps.Case.tags.priority
      description: The priority order of the tag.
      type: Number
    - contextPath: GoogleSecOps.Case.products.displayName
      description: The display name of the product.
      type: String
    - contextPath: GoogleSecOps.Case.products.alert
      description: The resource name of the alert associated with the product.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.id
      description: The ID of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.title
      description: The title of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.content
      description: The content/description of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.status
      description: The status of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.assignee
      description: The assignee of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.author
      description: The author who created the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.lastAuthor
      description: The last user who modified the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.createTime
      description: The creation time of the task (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.tasks.updateTime
      description: The last update time of the task (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.tasks.caseId
      description: The ID of the Case the task belongs to.
      type: Number
    - contextPath: GoogleSecOps.Case.tasks.favorite
      description: Whether the task is marked as a favorite.
      type: Boolean
    - contextPath: GoogleSecOps.Case.closureDetails.reason
      description: The closure reason of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.comment
      description: The closure comment of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.rootCause
      description: The root cause provided at closure.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.caseClosedAction
      description: The action taken when the Case was closed.
      type: String
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the new title for the case.\n\nNote: If the value is greater than 200 characters, it will be truncated to 200 characters."
      name: display_name
      required: false
    - description: "Specify the new description for the case.\n\nNote: If the value is greater than 1000 characters, it will be truncated to 1000 characters."
      name: description
      required: false
    - description: Specify whether to mark the case as important.
      name: important
      required: false
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    - description: Specify whether to mark the case as an incident.
      name: incident
      required: false
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    description: Update the properties of a case.
    name: gcb-case-update
    outputs:
    - contextPath: GoogleSecOps.Case.name
      description: The unique resource name of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.displayName
      description: The title of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.creatorUserId
      description: The ID of the user who created the Case.
      type: String
    - contextPath: GoogleSecOps.Case.lastModifyingUserId
      description: The ID of the user who last modified the Case.
      type: String
    - contextPath: GoogleSecOps.Case.createTime
      description: The creation time of the Case (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.updateTime
      description: The last update time of the Case (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.alertCount
      description: The number of alerts linked to the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.stage
      description: The current workflow stage of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.priority
      description: The priority of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.assignee
      description: The assigned user or SOC role of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.description
      description: The description of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.type
      description: The type of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.environment
      description: The logical environment of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.status
      description: The status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.score
      description: The attack exposure score of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.workflowStatus
      description: The playbook or workflow status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.source
      description: The source that created the Case.
      type: String
    - contextPath: GoogleSecOps.Case.important
      description: Whether the Case is marked as important.
      type: Boolean
    - contextPath: GoogleSecOps.Case.incident
      description: Whether the Case is marked as an incident.
      type: Boolean
    - contextPath: GoogleSecOps.Case.overflowCase
      description: Whether the Case is an overflow case due to large data volume.
      type: Boolean
    - contextPath: GoogleSecOps.Case.involvedSuspiciousEntity
      description: Whether a suspicious entity is involved in the Case.
      type: Boolean
    - contextPath: GoogleSecOps.Case.sla.expirationTime
      description: The SLA expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.sla.criticalExpirationTime
      description: The SLA critical expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.sla.expirationStatus
      description: The SLA expiration status of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.sla.remainingTimeSinceLastPause
      description: The remaining time since the last SLA pause of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.alertsSla.expirationTime
      description: The aggregated alerts SLA expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.criticalExpirationTime
      description: The aggregated alerts SLA critical expiration time of the Case (unix ms).
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.expirationStatus
      description: The aggregated alerts SLA expiration status.
      type: String
    - contextPath: GoogleSecOps.Case.alertsSla.remainingTimeSinceLastPause
      description: The remaining time since the last alerts SLA pause of the Case.
      type: Number
    - contextPath: GoogleSecOps.Case.tags.displayName
      description: The display name of the tag.
      type: String
    - contextPath: GoogleSecOps.Case.tags.priority
      description: The priority order of the tag.
      type: Number
    - contextPath: GoogleSecOps.Case.products.displayName
      description: The display name of the product.
      type: String
    - contextPath: GoogleSecOps.Case.products.alert
      description: The resource name of the alert associated with the product.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.id
      description: The ID of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.title
      description: The title of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.content
      description: The content/description of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.status
      description: The status of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.assignee
      description: The assignee of the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.author
      description: The author who created the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.lastAuthor
      description: The last user who modified the task.
      type: String
    - contextPath: GoogleSecOps.Case.tasks.createTime
      description: The creation time of the task (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.tasks.updateTime
      description: The last update time of the task (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.Case.tasks.caseId
      description: The ID of the Case the task belongs to.
      type: Number
    - contextPath: GoogleSecOps.Case.tasks.favorite
      description: Whether the task is marked as a favorite.
      type: Boolean
    - contextPath: GoogleSecOps.Case.closureDetails.reason
      description: The closure reason of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.comment
      description: The closure comment of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.rootCause
      description: The root cause provided at closure.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.caseClosedAction
      description: The action taken when the Case was closed.
      type: String
  - arguments:
    - description: "Specify the IDs of the case to add tags. Supports comma-separated values.\n\nNote: Use gcb-case-list to retrieve case ID."
      isArray: true
      name: case_ids
      required: true
    - description: Specify the tags to add to the cases. Supports comma-separated values.
      isArray: true
      name: tags
      required: true
    description: Add the specified tags to the cases.
    name: gcb-case-tag-add
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.recentlyAddedTags
      description: The list of recently added tags.
      type: String
  - arguments:
    - description: "Specify the ID of the case to remove the tag.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: Specify the tag to remove from the case.
      name: tag
      required: true
    description: Remove the specified tag from a case.
    name: gcb-case-tag-remove
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.recentlyRemovedTag
      description: The tag that was recently removed from the case.
      type: String
  - arguments:
    - description: "Specify the IDs of the case to change priority. Supports comma-separated values.\n\nNote: Use gcb-case-list to retrieve case ID."
      isArray: true
      name: case_ids
      required: true
    - auto: PREDEFINED
      description: "Specify the new priority level for the cases."
      name: priority
      predefined:
      - UNSPECIFIED
      - INFO
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      required: true
    description: Change the priority of the specified cases.
    name: gcb-case-priority-change
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.priority
      description: The updated priority of the Case.
      type: String
  - name: gcb-case-stage-definition-list
    description: Retrieve the list of case stage definitions configured in the instance.
    outputs:
    - contextPath: GoogleSecOps.CaseStageDefinition
      description: The list of the case stage definitions.
      type: Unknown
  - arguments:
    - description: "Specify the IDs of the case to change stage. Supports comma-separated values.\n\nNote: Use gcb-case-list to retrieve case ID."
      isArray: true
      name: case_ids
      required: true
    - auto: PREDEFINED
      description: "Specify the new workflow stage name.\n\nNote: Use gcb-case-stage-definition-list to retrieve case stage definition list."
      name: stage
      predefined:
      - Triage
      - Incident
      - Investigation
      required: true
    description: Change the workflow stage of the specified cases.
    name: gcb-case-stage-change
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.stage
      description: The updated workflow stage of the Case.
      type: String
  - arguments:
    - description: "Specify the IDs of the case to reopen. Supports comma-separated values.\n\nNote: Use gcb-case-list to retrieve case ID."
      isArray: true
      name: case_ids
      required: true
    - description: Specify a comment explaining why the cases are being reopened.
      name: reopen_comment
      required: true
    description: Reopen the specified cases.
    name: gcb-case-reopen
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.status
      description: The status of the Case after reopening.
      type: String
  - description: Retrieve the list of case close definitions configured in the instance.
    name: gcb-case-close-definition-list
    outputs:
    - contextPath: GoogleSecOps.CaseCloseDefinition.name
      description: The unique resource name of the Case close definition.
      type: String
    - contextPath: GoogleSecOps.CaseCloseDefinition.closeReason
      description: The close reason of the Case close definition.
      type: String
    - contextPath: GoogleSecOps.CaseCloseDefinition.rootCause
      description: The root cause of the Case close definition.
      type: String
  - arguments:
    - description: "Specify the IDs of the case to close. Supports comma-separated values.\n\nNote: Use gcb-case-list to retrieve case ID."
      isArray: true
      name: case_ids
      required: true
    - auto: PREDEFINED
      description: "Specify the reason for closing the cases."
      name: close_reason
      predefined:
      - MALICIOUS
      - NOT_MALICIOUS
      - MAINTENANCE
      - INCONCLUSIVE
      - UNKNOWN
      - CLOSE_REASON_UNSPECIFIED
      required: true
    - description: Specify the root cause description for the closure.
      name: root_cause
      required: true
    - description: Specify a comment to add when closing the cases.
      name: close_comment
      required: false
    description: Close the specified cases.
    name: gcb-case-close
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.status
      description: The status of the Case after closure.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.reason
      description: The closure reason of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.comment
      description: The closure comment of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.closureDetails.rootCause
      description: The root cause provided at closure.
      type: String
  - arguments:
    - description: "Specify the IDs of the case to assign. Supports comma-separated values.\n\nNote: Use gcb-case-list to retrieve case ID."
      isArray: true
      name: case_ids
      required: true
    - description: "Specify the user email address or a SOC role.\n\nFor SOC roles, add the @ prefix (for example, @Tier1)."
      name: assignee
      required: true
    description: Assign the specified cases to a specific analyst or SOC role.
    name: gcb-case-assign
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.assignee
      description: The resolved user ID or SOC role assigned to the Case after the operation.
      type: String
  - arguments:
    - description: "Specify the ID of the case to retrieve comments.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - defaultValue: '50'
      description: "Specify the maximum number of comments to return.\n\nNote: Maximum value is 1000."
      name: page_size
    - description: "Specify the page token for pagination.\n\nNote: Use the next_page_token from a previous gcb-case-comment-list response."
      name: page_token
    - auto: PREDEFINED
      defaultValue: createTime
      description: "Specify the field to sort results by."
      name: sort_by
      predefined:
      - createTime
      - updateTime
      - user
      - comment
      - deletionInvoker
      - favorite
      - alert
      - deleted
    - auto: PREDEFINED
      defaultValue: Desc
      description: "Specify the sort direction for the results."
      name: sort_order
      predefined:
      - Asc
      - Desc
    description: Retrieve the list of comments associated with the specified case.
    name: gcb-case-comment-list
    outputs:
    - contextPath: GoogleSecOps.CaseComment.name
      description: The unique resource name of the Case comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.commentId
      description: The ID of the Case comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.createTime
      description: The creation time of the Case comment (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseComment.updateTime
      description: The last update time of the Case comment (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseComment.user
      description: User owner of the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.comment
      description: The text of the Case comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.userOwnerFullName
      description: The user who created the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.lastEditorFullName
      description: The user who last edited the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.deletedByUser
      description: The user who deleted the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.alertIdentifier
      description: The alert associated with the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.isFavorite
      description: Whether the comment is marked as a favorite.
      type: Boolean
    - contextPath: GoogleSecOps.CaseComment.isDeleted
      description: Indicates if the comment has been softly deleted.
      type: Boolean
    - contextPath: GoogleSecOps.CaseComment.case
      description: The case associated with the comment.
      type: String
    - contextPath: GoogleSecOps.PageToken.command
      description: The command name associated with the pagination token.
      type: String
    - contextPath: GoogleSecOps.PageToken.nextPageToken
      description: Token to fetch the next page of case comments.
      type: String
    - contextPath: GoogleSecOps.PageToken.totalSize
      description: The total number of case comments available.
      type: Number
  - arguments:
    - description: "Specify the ID of the case to add the comment.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: Specify the comment text to add to the case.
      name: comment
      required: true
    description: Add a comment to the specified case.
    name: gcb-case-comment-create
    outputs:
    - contextPath: GoogleSecOps.CaseComment.name
      description: The unique resource name of the Case comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.commentId
      description: The ID of the Case comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.createTime
      description: The creation time of the Case comment (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseComment.updateTime
      description: The last update time of the Case comment (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseComment.user
      description: User owner of the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.comment
      description: The text of the Case comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.userOwnerFullName
      description: The user who created the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.lastEditorFullName
      description: The user who last edited the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.deletedByUser
      description: The user who deleted the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.alertIdentifier
      description: The alert associated with the comment.
      type: String
    - contextPath: GoogleSecOps.CaseComment.isFavorite
      description: Whether the comment is marked as a favorite.
      type: Boolean
    - contextPath: GoogleSecOps.CaseComment.isDeleted
      description: Indicates if the comment has been softly deleted.
      type: Boolean
    - contextPath: GoogleSecOps.CaseComment.case
      description: The case associated with the comment.
      type: String
  - arguments:
    - description: "Specify the ID of the case to pause the SLA timer.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: Specify the reason for pausing the SLA timer.
      name: message
    description: Pause the SLA timer for the specified case.
    name: gcb-case-sla-pause
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.slaStatus
      description: The SLA status of the Case after the operation.
      type: String
  - arguments:
    - description: "Specify the ID of the case to resume the SLA timer.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    description: Resume the SLA timer for the specified case.
    name: gcb-case-sla-resume
    outputs:
    - contextPath: GoogleSecOps.Case.caseId
      description: The ID of the Case.
      type: String
    - contextPath: GoogleSecOps.Case.slaStatus
      description: The SLA status of the Case after the operation.
      type: String
  - arguments:
    - description: "Specify the ID of the case to list alerts.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: Filter alerts by display name. Supports comma-separated values.
      isArray: true
      name: display_name
    - auto: PREDEFINED
      description: "Filter alerts by priority. Supports comma-separated values."
      isArray: true
      name: priority
      predefined:
      - LEGACY_CASE_PRIORITY_UNSPECIFIED
      - UNCHANGED
      - INFORMATIVE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    - auto: PREDEFINED
      description: Filter alerts by status. Supports comma-separated values.
      isArray: true
      name: status
      predefined:
      - OPEN
      - CLOSE
      - ALERT_STATUS_UNSPECIFIED
    - description: Filter alerts by product name. Supports comma-separated values.
      isArray: true
      name: product
    - description: Filter alerts by vendor name. Supports comma-separated values.
      isArray: true
      name: vendor
    - description: Filter alerts by tag name. Supports comma-separated values.
      isArray: true
      name: tag
    - description: Filter alerts by environment name. Supports comma-separated values.
      isArray: true
      name: environment
    - description: Filter alerts by the alerting system that raised the alert. Supports comma-separated values.
      isArray: true
      name: source_system_name
    - auto: PREDEFINED
      description: Filter alerts by whether they were created manually.
      name: manual
      predefined:
      - 'True'
      - 'False'
    - description: "Filter alerts created on or after this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: create_start_time
    - description: "Filter alerts created on or before this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: create_end_time
    - description: "Filter alerts updated on or after this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: update_start_time
    - description: "Filter alerts updated on or before this time.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 2026-05-17T14:05:44Z."
      name: update_end_time
    - description: "Specify a raw AIP-160 filter string to query alerts with advanced conditions. When provided, this filter is used as-is and all other filter arguments are ignored.\n\nNote: Supported filter fields: displayName, product, vendor, environment, sourceSystemName, priority, status, createTime, updateTime.\n\nExample: (priority='HIGH' OR status='OPEN') AND product='DLP'."
      name: advanced_filter
    - auto: PREDEFINED
      defaultValue: AND
      description: Specify the logical operator to combine filter conditions.
      name: filter_logic
      predefined:
      - AND
      - OR
    - defaultValue: '50'
      description: "Specify the maximum number of alerts to return.\n\nNote: Maximum value is 1000."
      name: page_size
    - description: "Specify the page token for pagination.\n\nNote: Use the next_page_token from a previous gcb-case-alert-list response."
      name: page_token
    - auto: PREDEFINED
      defaultValue: createTime
      description: "Specify the field to sort results by."
      name: sort_by
      predefined:
      - displayName
      - caseId
      - identifier
      - sourceGroupingIdentifier
      - product
      - vendor
      - environment
      - ticketId
      - sourceSystemName
      - priority
      - status
      - startTime
      - endTime
      - createTime
    - auto: PREDEFINED
      defaultValue: Desc
      description: Specify the sort direction for the results.
      name: sort_order
      predefined:
      - Asc
      - Desc
    description: Retrieve the list of alerts associated with the specified case.
    name: gcb-case-alert-list
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.name
      description: The unique resource name of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert extracted from the resource name.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.identifier
      description: The legacy identifier (alert title + GUID) of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceGroupingIdentifier
      description: The source grouping identifier used to group related Case Alerts.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.alertGroupIdentifier
      description: The alert group identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.displayName
      description: The display name of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.product
      description: The product associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.vendor
      description: The vendor associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.environment
      description: The environment of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceSystemName
      description: The alerting system that raised the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceIdentifier
      description: The source identifier (e.g. connector ID) of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.ruleGenerator
      description: The third-party rule that triggered the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.siemAlertId
      description: The SIEM alert identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceUrl
      description: The source URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceRuleUrl
      description: The source rule URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceSystemUrl
      description: The source system URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceRuleIdentifier
      description: The source rule identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.ticketId
      description: The ticket ID linked to the Case Alert in the integrated ticketing system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.additionalProperties
      description: The additional connector data of the Case Alert as a JSON string.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.priority
      description: The priority of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.status
      description: The status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.manual
      description: Whether the Case Alert was created manually.
      type: Boolean
    - contextPath: GoogleSecOps.CaseAlert.nestingDepth
      description: The nesting depth level of the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.playbookStatus
      description: The playbook or workflow status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.attachedPlaybookName
      description: The name of the playbook attached to the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.eventCount
      description: The number of events that triggered the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.playbookRunCount
      description: The number of times the first playbook was run for the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.createTime
      description: The creation time of the Case Alert (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.updateTime
      description: The last update time of the Case Alert (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.startTime
      description: The time the alert was created on the third-party system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.endTime
      description: The time the alert was closed on the third-party system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.expirationStatus
      description: The SLA expiration status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.expirationTime
      description: The SLA expiration time of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.criticalExpirationTime
      description: The SLA critical expiration time of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.remainingTimeSinceLastPause
      description: The remaining time since the last SLA pause of the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.tags.tag
      description: The tag value associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.reason
      description: The closure reason of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.comment
      description: The closure comment of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.rootCause
      description: The root cause provided at closure of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.closingTimeMs
      description: The closure time of the Case Alert in Unix milliseconds.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.identifier
      description: The identifier of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.alertIdentifier
      description: The identifier of the alert the Involved Relation belongs to.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.caseId
      description: The Case ID the Involved Relation belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.relationType
      description: The type of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.deviceProduct
      description: The product associated with the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.deviceVendor
      description: The vendor associated with the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.categoryOutcome
      description: The category outcome of the Involved Relation (e.g. Blocked, Allowed).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.destinationPort
      description: The destination port of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.eventClassId
      description: The event display name of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.startTime
      description: The start time of the Involved Relation.
      type: Date
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.endTime
      description: The end time of the Involved Relation.
      type: Date
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.additionalProperties
      description: The additional data of the Involved Relation as a JSON string.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.from.identifier
      description: The identifier of the source entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.from.type
      description: The type of the source entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.to.identifier
      description: The identifier of the destination entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.to.type
      description: The type of the destination entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.PageToken.command
      description: The command name associated with the pagination token.
      type: String
    - contextPath: GoogleSecOps.PageToken.nextPageToken
      description: The token to retrieve the next page of Case Alerts.
      type: String
    - contextPath: GoogleSecOps.PageToken.totalSize
      description: The total number of Case Alerts matching the query.
      type: Number
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to retrieve.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    description: Retrieve detailed information about a specific case alert by its ID.
    name: gcb-case-alert-get
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.name
      description: The unique resource name of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert extracted from the resource name.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.identifier
      description: The legacy identifier (alert title + GUID) of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceGroupingIdentifier
      description: The source grouping identifier used to group related Case Alerts.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.alertGroupIdentifier
      description: The alert group identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.displayName
      description: The display name of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.product
      description: The product associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.vendor
      description: The vendor associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.environment
      description: The environment of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceSystemName
      description: The alerting system that raised the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceIdentifier
      description: The source identifier (e.g. connector ID) of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.ruleGenerator
      description: The third-party rule that triggered the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.siemAlertId
      description: The SIEM alert identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceUrl
      description: The source URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceRuleUrl
      description: The source rule URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceSystemUrl
      description: The source system URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceRuleIdentifier
      description: The source rule identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.ticketId
      description: The ticket ID linked to the Case Alert in the integrated ticketing system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.additionalProperties
      description: The additional connector data of the Case Alert as a JSON string.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.priority
      description: The priority of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.status
      description: The status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.manual
      description: Whether the Case Alert was created manually.
      type: Boolean
    - contextPath: GoogleSecOps.CaseAlert.nestingDepth
      description: The nesting depth level of the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.playbookStatus
      description: The playbook or workflow status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.attachedPlaybookName
      description: The name of the playbook attached to the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.eventCount
      description: The number of events that triggered the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.playbookRunCount
      description: The number of times the first playbook was run for the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.createTime
      description: The creation time of the Case Alert (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.updateTime
      description: The last update time of the Case Alert (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.startTime
      description: The time the alert was created on the third-party system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.endTime
      description: The time the alert was closed on the third-party system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.slaStatus
      description: The SLA expiration status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.slaExpireTime
      description: The SLA expiration time of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.tags.tag
      description: The tag value associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.reason
      description: The closure reason of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.comment
      description: The closure comment of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.rootCause
      description: The root cause provided at closure of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.closingTimeMs
      description: The closure time of the Case Alert in Unix milliseconds.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.identifier
      description: The identifier of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.alertIdentifier
      description: The identifier of the alert the Involved Relation belongs to.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.caseId
      description: The Case ID the Involved Relation belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.relationType
      description: The type of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.deviceProduct
      description: The product associated with the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.deviceVendor
      description: The vendor associated with the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.categoryOutcome
      description: The category outcome of the Involved Relation (e.g. Blocked, Allowed).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.destinationPort
      description: The destination port of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.eventClassId
      description: The event display name of the Involved Relation (e.g. Email Check, Data Exfiltration).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.startTime
      description: The start time of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.endTime
      description: The end time of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.additionalProperties
      description: The additional data of the Involved Relation as a JSON string.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.from.identifier
      description: The identifier of the source entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.from.type
      description: The type of the source entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.to.identifier
      description: The identifier of the destination entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.to.type
      description: The type of the destination entity of the Involved Relation.
      type: String
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to update.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: Specify the new status for the alert.
      name: status
      predefined:
      - ALERT_STATUS_UNSPECIFIED
      - OPEN
      - CLOSE
      required: false
    - auto: PREDEFINED
      description: Specify the new priority for the alert.
      name: priority
      predefined:
      - LEGACY_CASE_PRIORITY_UNSPECIFIED
      - UNCHANGED
      - INFORMATIVE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
      required: false
    - auto: PREDEFINED
      description: "Specify the reason for closing the alert.\n\nNote: Required when status is CLOSE."
      name: close_reason
      predefined:
      - MALICIOUS
      - NOT_MALICIOUS
      - MAINTENANCE
      - INCONCLUSIVE
      - UNKNOWN
      - CLOSE_REASON_UNSPECIFIED
      required: false
    - description: Specify a comment to add when closing the alert.
      name: close_comment
      required: false
    - description: "Specify the root cause for the alert closure.\n\nNote: Required when status is CLOSE."
      name: root_cause
      required: false
    description: Update the properties of an existing case alert.
    name: gcb-case-alert-update
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.name
      description: The unique resource name of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert extracted from the resource name.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.identifier
      description: The legacy identifier (alert title + GUID) of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceGroupingIdentifier
      description: The source grouping identifier used to group related Case Alerts.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.alertGroupIdentifier
      description: The alert group identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.displayName
      description: The display name of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.product
      description: The product associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.vendor
      description: The vendor associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.environment
      description: The environment of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceSystemName
      description: The alerting system that raised the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceIdentifier
      description: The source identifier (e.g. connector ID) of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.ruleGenerator
      description: The third-party rule that triggered the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.siemAlertId
      description: The SIEM alert identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceUrl
      description: The source URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceRuleUrl
      description: The source rule URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceSystemUrl
      description: The source system URL of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sourceRuleIdentifier
      description: The source rule identifier of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.ticketId
      description: The ticket ID linked to the Case Alert in the integrated ticketing system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.additionalProperties
      description: The additional connector data of the Case Alert as a JSON string.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.priority
      description: The priority of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.status
      description: The status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.manual
      description: Whether the Case Alert was created manually.
      type: Boolean
    - contextPath: GoogleSecOps.CaseAlert.nestingDepth
      description: The nesting depth level of the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.playbookStatus
      description: The playbook or workflow status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.attachedPlaybookName
      description: The name of the playbook attached to the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.eventCount
      description: The number of events that triggered the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.playbookRunCount
      description: The number of times the first playbook was run for the Case Alert.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.createTime
      description: The creation time of the Case Alert (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.updateTime
      description: The last update time of the Case Alert (unix epoch milliseconds).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.startTime
      description: The time the alert was created on the third-party system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.endTime
      description: The time the alert was closed on the third-party system.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.slaStatus
      description: The SLA expiration status of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.sla.slaExpireTime
      description: The SLA expiration time of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.tags.tag
      description: The tag value associated with the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.reason
      description: The closure reason of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.comment
      description: The closure comment of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.rootCause
      description: The root cause provided at closure of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.closureDetails.closingTimeMs
      description: The closure time of the Case Alert in Unix milliseconds.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.identifier
      description: The identifier of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.alertIdentifier
      description: The identifier of the alert the Involved Relation belongs to.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.caseId
      description: The Case ID the Involved Relation belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.relationType
      description: The type of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.deviceProduct
      description: The product associated with the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.deviceVendor
      description: The vendor associated with the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.categoryOutcome
      description: The category outcome of the Involved Relation (e.g. Blocked, Allowed).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.destinationPort
      description: The destination port of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.eventClassId
      description: The event display name of the Involved Relation (e.g. Email Check, Data Exfiltration).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.startTime
      description: The start time of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.endTime
      description: The end time of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.additionalProperties
      description: The additional data of the Involved Relation as a JSON string.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.from.identifier
      description: The identifier of the source entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.from.type
      description: The type of the source entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.to.identifier
      description: The identifier of the destination entity of the Involved Relation.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.involvedRelations.to.type
      description: The type of the destination entity of the Involved Relation.
      type: String
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to add a tag.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: Specify the tag to add to the alert.
      name: tag
      required: true
    description: Add a tag to a case alert.
    name: gcb-case-alert-tag-add
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.recentlyAddedTag
      description: The recently added tag.
      type: String
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to remove a tag.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: Specify the tag to remove from the alert.
      name: tag
      required: true
    description: Remove a tag from a case alert.
    name: gcb-case-alert-tag-remove
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.recentlyRemovedTag
      description: The tag that was recently removed from the case alert.
      type: String
  - arguments:
    - description: "Specify the ID of the source case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to move.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: "Specify the destination case ID to move the alert to.\n\nNote: Use gcb-case-list to retrieve destination case ID."
      name: destination_case_id
      required: true
    description: "Move a case alert to a different case.\n\nNote: Both source and destination cases must be open."
    name: gcb-case-alert-move
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The Case ID the alert was moved to.
      type: Number
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to pause the SLA timer.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: "Specify the reason for pausing the SLA timer."
      name: message
    description: Pause the SLA timer for the specified case alert.
    name: gcb-case-alert-sla-pause
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.slaExpirationStatus
      description: The SLA expiration status of the Case Alert after the operation.
      type: String
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to resume the SLA timer.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    description: Resume the SLA timer for the specified case alert.
    name: gcb-case-alert-sla-resume
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.slaExpirationStatus
      description: The SLA expiration status of the Case Alert after the operation.
      type: String
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to set the SLA.\n\nNote: The alert must be open. Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: "Specify the total SLA duration.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 2 weeks, 01 May 2026, 2026-05-17T14:05:44Z."
      name: total_time
      required: true
    - description: "Specify the critical SLA threshold.\n\nNote: Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 2 weeks, 01 May 2026, 2026-05-17T14:05:44Z."
      name: critical_time
    description: "Set the SLA parameters for a case alert.\n\nNote: When critical_time is specified, total_time must be greater than critical_time."
    name: gcb-case-alert-sla-set
    outputs:
    - contextPath: GoogleSecOps.CaseAlert.alertId
      description: The ID of the Case Alert.
      type: String
    - contextPath: GoogleSecOps.CaseAlert.caseId
      description: The ID of the Case the alert belongs to.
      type: Number
    - contextPath: GoogleSecOps.CaseAlert.slaExpirationTime
      description: The SLA expiration time of the Case Alert (epoch ms).
      type: String
    - contextPath: GoogleSecOps.CaseAlert.slaCriticalExpirationTime
      description: The SLA critical expiration time of the Case Alert (epoch ms).
      type: String
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to generate a recommendation.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    description: Initiate an asynchronous AI recommendation for a case alert.
    name: gcb-case-alert-recommendation-create
    outputs:
    - contextPath: GoogleSecOps.AlertRecommendation.parent
      description: The resource name of the Case Alert the recommendation belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertRecommendation.recommendationId
      description: The ID of the created recommendation.
      type: String
  - arguments:
    - description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: Specify the recommendation ID returned by gcb-case-alert-recommendation-create command.
      name: recommendation_id
      required: true
    description: Fetch a previously generated AI recommendation for a case alert.
    name: gcb-case-alert-recommendation-fetch
    outputs:
    - contextPath: GoogleSecOps.AlertRecommendation.parent
      description: The resource name of the Case Alert the recommendation belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertRecommendation.recommendationId
      description: The ID of the recommendation.
      type: String
    - contextPath: GoogleSecOps.AlertRecommendation.recommendation
      description: The AI-generated recommendation text for the Case Alert.
      type: String
    - contextPath: GoogleSecOps.AlertRecommendation.alertIdentifierToCaseId
      description: Mapping of alert identifiers to their associated Case IDs.
      type: Unknown
    - contextPath: GoogleSecOps.AlertRecommendation.marketplaceActionsTriggeredManually
      description: List of marketplace actions that were manually triggered on the alert.
      type: Unknown
    - contextPath: GoogleSecOps.AlertRecommendation.state
      description: The current state of the recommendation generation.
      type: String
  - name: gcb-case-alert-customfield-list
    description: Retrieve the list of custom field values associated with a case alert.
    arguments:
    - name: case_id
      required: true
      description: "Specify the ID of the case the alert belongs to.\n\nNote: Use gcb-case-list to retrieve case ID."
    - name: alert_id
      required: true
      description: "Specify the ID of the case alert to list custom field values.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
    - name: page_size
      required: false
      defaultValue: '50'
      description: "Specify the maximum number of custom field values to return.\n\nNote: Maximum value is 1000."
    - name: page_token
      required: false
      description: "Specify the page token for pagination.\n\nNote: Use the next_page_token from a previous gcb-case-alert-customfield-list response."
    outputs:
    - contextPath: GoogleSecOps.AlertCustomFieldValue.name
      description: The unique resource name of the Custom Field Value.
      type: String
    - contextPath: GoogleSecOps.AlertCustomFieldValue.customFieldId
      description: The ID of the parent Custom Field.
      type: String
    - contextPath: GoogleSecOps.AlertCustomFieldValue.displayName
      description: The display name of the Custom Field resolved from the custom field ID.
      type: String
    - contextPath: GoogleSecOps.AlertCustomFieldValue.scope
      description: The scope of the Custom Field Value.
      type: String
    - contextPath: GoogleSecOps.AlertCustomFieldValue.scopeId
      description: The identifier of the scope (case or alert) this value references.
      type: String
    - contextPath: GoogleSecOps.AlertCustomFieldValue.values
      description: The value(s) for the Custom Field.
      type: Unknown
    - contextPath: GoogleSecOps.AlertCustomFieldValue.valuesSearchText
      description: The concatenated search text for all values of the Custom Field.
      type: String
    - contextPath: GoogleSecOps.PageToken.command
      description: The command name for which the page token applies.
      type: String
    - contextPath: GoogleSecOps.PageToken.nextPageToken
      description: The token to retrieve the next page of Custom Field Values.
      type: String
    - contextPath: GoogleSecOps.PageToken.totalSize
      description: The total number of Custom Field Values available.
      type: Number
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert to list entities.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - defaultValue: '50'
      description: "Specify the maximum number of entities to return.\n\nNote: Maximum value is 1000."
      name: page_size
    - description: "Specify the page token for pagination.\n\nNote: Use the next_page_token from a previous gcb-case-alert-entity-list response."
      name: page_token
    - auto: PREDEFINED
      description: "Filter entities by type. Supports comma-separated values."
      name: entity_type
      isArray: true
      predefined:
      - ADDRESS
      - HOSTNAME
      - PROCESS
      - USB
    - auto: PREDEFINED
      description: "Filter entities by suspicious status."
      name: suspicious
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: "Filter entities by internal status."
      name: internal
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: "Filter entities by attacker designation."
      name: attacker
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: "Filter entities by pivot designation."
      name: pivot
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: "Filter entities by enrichment status."
      name: enriched
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: "Filter entities by artifact flag."
      name: artifact
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: "Filter entities by vulnerable flag."
      name: vulnerable
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: "Filter entities by manually created flag."
      name: manually_created
      predefined:
      - 'true'
      - 'false'
    - description: "Filter entities by threat source. Supports comma-separated values."
      name: threat_source
      isArray: true
    - description: "Filter entities by operating system. Supports comma-separated values."
      name: operating_system
      isArray: true
    - description: "Filter entities by network name. Supports comma-separated values."
      name: network_title
      isArray: true
    - description: "Filter entities by network priority (integer values). Supports comma-separated values."
      name: network_priority
      isArray: true
    - description: "Filter entities by environment. Supports comma-separated values."
      name: environment
      isArray: true
    - description: "Specify a raw filter expression to query entities with advanced conditions. When provided, this filter is used as-is and all other filter arguments are ignored.\n\nNote: Supported filter fields: type, suspicious, internal, attacker, pivot, enriched, artifact, vulnerable, manuallyCreated, threatSource, operatingSystem, networkTitle, networkPriority, environment, fields.\n\nExample: type='ADDRESS' AND suspicious=true AND internal=false."
      name: advanced_filter
    - auto: PREDEFINED
      defaultValue: id
      description: "Specify the field to sort results by."
      name: sort_by
      predefined:
      - id
      - entityType
      - suspicious
      - internal
      - attacker
      - pivot
      - enriched
      - artifact
      - vulnerable
      - manuallyCreated
      - threatSource
      - operatingSystem
      - networkTitle
      - networkPriority
      - environment
    - auto: PREDEFINED
      defaultValue: Desc
      description: "Specify the sort direction for the results."
      name: sort_order
      predefined:
      - Asc
      - Desc
    - auto: PREDEFINED
      defaultValue: AND
      description: "Specify the logical operator to combine filter conditions."
      name: filter_logic
      predefined:
      - AND
      - OR
    description: Retrieve the list of entities associated with a case alert.
    name: gcb-case-alert-entity-list
    outputs:
    - contextPath: GoogleSecOps.AlertEntity.id
      description: The immutable identifier of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.identifier
      description: The identifier name of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.type
      description: The type of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.caseId
      description: The Case ID the Involved Entity belongs to.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.alertIdentifier
      description: The alert identifier the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.environment
      description: The environment of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.threatSource
      description: The threat source associated with the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.operatingSystem
      description: The operating system of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkTitle
      description: The network name related to the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkPriority
      description: The network priority of the Involved Entity.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.entityUri
      description: The full URL of the Involved Entity in the source system.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.sourceSystemUri
      description: The source system URI link of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.additionalProperties
      description: The additional properties of the Involved Entity as a JSON string.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.suspicious
      description: Whether the Involved Entity is considered suspicious.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.internal
      description: Whether the Involved Entity is internal.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.attacker
      description: Whether the Involved Entity represents an attacker.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.pivot
      description: Whether the Involved Entity is a pivot entity common to multiple cases.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.manuallyCreated
      description: Whether the Involved Entity was added manually.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.enriched
      description: Whether the Involved Entity has been enriched by an external action.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.artifact
      description: Whether the Involved Entity is an artifact.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.vulnerable
      description: Whether the Involved Entity is vulnerable.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.displayName
      description: The display name of the context group of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.highlighted
      description: Whether the context group of the Involved Entity is highlighted.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.hidden
      description: Whether the context group of the Involved Entity is hidden.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.items.name
      description: The property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.originalName
      description: The original property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.value
      description: The value of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.PageToken.command
      description: The command name associated with the pagination token.
      type: String
    - contextPath: GoogleSecOps.PageToken.nextPageToken
      description: Token to fetch the next page of alert entities.
      type: String
    - contextPath: GoogleSecOps.PageToken.totalSize
      description: The total number of alert entities available.
      type: Number
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: "Specify the ID of the involved entity to retrieve.\n\nNote: Use gcb-case-alert-entity-list to retrieve entity ID."
      name: entity_id
      required: true
    description: Retrieve detailed information about a specific involved entity in a case alert.
    name: gcb-case-alert-entity-get
    outputs:
    - contextPath: GoogleSecOps.AlertEntity.id
      description: The immutable identifier of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.identifier
      description: The identifier name of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.type
      description: The type of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.alertId
      description: The Alert ID the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.caseId
      description: The Case ID the Involved Entity belongs to.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.alertIdentifier
      description: The alert identifier the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.environment
      description: The environment of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.threatSource
      description: The threat source associated with the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.operatingSystem
      description: The operating system of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkTitle
      description: The network name related to the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkPriority
      description: The network priority of the Involved Entity.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.entityUri
      description: The full URL of the Involved Entity in the source system.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.sourceSystemUri
      description: The source system URI link of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.additionalProperties
      description: The additional properties of the Involved Entity as a JSON string.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.suspicious
      description: Whether the Involved Entity is considered suspicious.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.internal
      description: Whether the Involved Entity is internal.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.attacker
      description: Whether the Involved Entity represents an attacker.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.pivot
      description: Whether the Involved Entity is a pivot entity common to multiple cases.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.manuallyCreated
      description: Whether the Involved Entity was added manually.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.enriched
      description: Whether the Involved Entity has been enriched by an external action.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.artifact
      description: Whether the Involved Entity is an artifact.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.vulnerable
      description: Whether the Involved Entity is vulnerable.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.displayName
      description: The display name of the context group of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.highlighted
      description: Whether the context group of the Involved Entity is highlighted.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.hidden
      description: Whether the context group of the Involved Entity is hidden.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.items.name
      description: The property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.originalName
      description: The original property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.value
      description: The value of the context group item of the Involved Entity.
      type: String
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: Specify the identifier name of the entity (e.g. IP address, hostname value, process name).
      name: identifier
      required: true
    - auto: PREDEFINED
      description: "Specify the type of the new entity.\n\nNote: Immutable after creation."
      name: entity_type
      predefined:
      - ADDRESS
      - HOSTNAME
      - PROCESS
      - USB
      required: true
    - auto: PREDEFINED
      description: Specify whether the entity is suspicious.
      name: suspicious
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify whether the entity is internal to the organization.
      name: internal
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify whether the entity represents an attacker.
      name: attacker
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify whether the entity is a pivot entity common to multiple cases.
      name: pivot
      predefined:
      - 'true'
      - 'false'
    - description: Specify the operating system of the entity.
      name: operating_system
    - description: Specify the network name related to the entity.
      name: network_title
    - description: Specify the threat source name associated with the entity.
      name: threat_source
    - description: Specify the network priority of the entity (non-negative integer).
      name: network_priority
    description: Manually create a new involved entity within a case alert.
    name: gcb-case-alert-entity-create
    outputs:
    - contextPath: GoogleSecOps.AlertEntity.id
      description: The immutable identifier of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.identifier
      description: The identifier name of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.type
      description: The type of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.alertId
      description: The Alert ID the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.caseId
      description: The Case ID the Involved Entity belongs to.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.alertIdentifier
      description: The alert identifier the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.environment
      description: The environment of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.threatSource
      description: The threat source associated with the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.operatingSystem
      description: The operating system of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkTitle
      description: The network name related to the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkPriority
      description: The network priority of the Involved Entity.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.entityUri
      description: The full URL of the Involved Entity in the source system.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.sourceSystemUri
      description: The source system URI link of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.additionalProperties
      description: The additional properties of the Involved Entity as a JSON string.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.suspicious
      description: Whether the Involved Entity is considered suspicious.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.internal
      description: Whether the Involved Entity is internal.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.attacker
      description: Whether the Involved Entity represents an attacker.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.pivot
      description: Whether the Involved Entity is a pivot entity common to multiple cases.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.manuallyCreated
      description: Whether the Involved Entity was added manually.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.enriched
      description: Whether the Involved Entity has been enriched by an external action.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.artifact
      description: Whether the Involved Entity is an artifact.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.vulnerable
      description: Whether the Involved Entity is vulnerable.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.displayName
      description: The display name of the context group of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.highlighted
      description: Whether the context group of the Involved Entity is highlighted.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.hidden
      description: Whether the context group of the Involved Entity is hidden.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.items.name
      description: The property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.originalName
      description: The original property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.value
      description: The value of the context group item of the Involved Entity.
      type: String
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: "Specify the ID of the involved entity to update.\n\nNote: Use gcb-case-alert-entity-list to retrieve entity ID."
      name: entity_id
      required: true
    - auto: PREDEFINED
      description: Specify the updated suspicion flag for the entity.
      name: suspicious
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify the updated internal flag for the entity.
      name: internal
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify the updated attacker designation for the entity.
      name: attacker
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify the updated pivot designation for the entity.
      name: pivot
      predefined:
      - 'true'
      - 'false'
    - description: Specify the updated operating system of the entity.
      name: operating_system
    - description: Specify the updated network name related to the entity.
      name: network_title
    - description: Specify the updated threat source associated with the entity.
      name: threat_source
    - description: Specify the updated network priority associated with the entity (non-negative integer).
      name: network_priority
    description: Update the attributes of an existing involved entity in a case alert.
    name: gcb-case-alert-entity-update
    outputs:
    - contextPath: GoogleSecOps.AlertEntity.id
      description: The immutable identifier of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.identifier
      description: The identifier name of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.type
      description: The type of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.alertId
      description: The Alert ID the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.caseId
      description: The Case ID the Involved Entity belongs to.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.alertIdentifier
      description: The alert identifier the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.environment
      description: The environment of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.threatSource
      description: The threat source associated with the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.operatingSystem
      description: The operating system of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkTitle
      description: The network name related to the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkPriority
      description: The network priority of the Involved Entity.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.entityUri
      description: The full URL of the Involved Entity in the source system.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.sourceSystemUri
      description: The source system URI link of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.additionalProperties
      description: The additional properties of the Involved Entity as a JSON string.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.suspicious
      description: Whether the Involved Entity is considered suspicious.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.internal
      description: Whether the Involved Entity is internal.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.attacker
      description: Whether the Involved Entity represents an attacker.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.pivot
      description: Whether the Involved Entity is a pivot entity common to multiple cases.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.manuallyCreated
      description: Whether the Involved Entity was added manually.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.enriched
      description: Whether the Involved Entity has been enriched by an external action.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.artifact
      description: Whether the Involved Entity is an artifact.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.vulnerable
      description: Whether the Involved Entity is vulnerable.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.displayName
      description: The display name of the context group of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.highlighted
      description: Whether the context group of the Involved Entity is highlighted.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.hidden
      description: Whether the context group of the Involved Entity is hidden.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.items.name
      description: The property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.originalName
      description: The original property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.value
      description: The value of the context group item of the Involved Entity.
      type: String
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: "Specify the ID of the involved entity to add a property.\n\nNote: Use gcb-case-alert-entity-list to retrieve entity ID."
      name: entity_id
      required: true
    - description: "Specify the property key to add.\n\nNote: The key must not already exist on the entity."
      name: key
      required: true
    - description: Specify the value for the new property.
      name: value
      required: true
    description: Add a new custom property to an involved entity in a case alert.
    name: gcb-case-alert-entity-property-add
    outputs:
    - contextPath: GoogleSecOps.AlertEntity.id
      description: The immutable identifier of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.identifier
      description: The identifier name of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.type
      description: The type of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.alertId
      description: The Alert ID the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.caseId
      description: The Case ID the Involved Entity belongs to.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.alertIdentifier
      description: The alert identifier the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.environment
      description: The environment of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.threatSource
      description: The threat source associated with the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.operatingSystem
      description: The operating system of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkTitle
      description: The network name related to the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkPriority
      description: The network priority of the Involved Entity.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.entityUri
      description: The full URL of the Involved Entity in the source system.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.sourceSystemUri
      description: The source system URI link of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.additionalProperties
      description: The additional properties of the Involved Entity as a JSON string.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.suspicious
      description: Whether the Involved Entity is considered suspicious.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.internal
      description: Whether the Involved Entity is internal.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.attacker
      description: Whether the Involved Entity represents an attacker.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.pivot
      description: Whether the Involved Entity is a pivot entity common to multiple cases.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.manuallyCreated
      description: Whether the Involved Entity was added manually.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.enriched
      description: Whether the Involved Entity has been enriched by an external action.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.artifact
      description: Whether the Involved Entity is an artifact.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.vulnerable
      description: Whether the Involved Entity is vulnerable.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.displayName
      description: The display name of the context group of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.highlighted
      description: Whether the context group of the Involved Entity is highlighted.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.hidden
      description: Whether the context group of the Involved Entity is hidden.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.items.name
      description: The property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.originalName
      description: The original property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.value
      description: The value of the context group item of the Involved Entity.
      type: String
  - arguments:
    - description: "Specify the ID of the case.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the ID of the case alert.\n\nNote: Use gcb-case-alert-list to retrieve alert ID."
      name: alert_id
      required: true
    - description: "Specify the ID of the involved entity to update the property.\n\nNote: Use gcb-case-alert-entity-list to retrieve entity ID."
      name: entity_id
      required: true
    - description: Specify the existing property key whose value should be updated.
      name: key
      required: true
    - description: Specify the new value for the property.
      name: value
      required: true
    description: Update an existing custom property value on an involved entity in a case alert.
    name: gcb-case-alert-entity-property-update
    outputs:
    - contextPath: GoogleSecOps.AlertEntity.id
      description: The immutable identifier of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.identifier
      description: The identifier name of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.type
      description: The type of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.alertId
      description: The Alert ID the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.caseId
      description: The Case ID the Involved Entity belongs to.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.alertIdentifier
      description: The alert identifier the Involved Entity belongs to.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.environment
      description: The environment of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.threatSource
      description: The threat source associated with the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.operatingSystem
      description: The operating system of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkTitle
      description: The network name related to the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.networkPriority
      description: The network priority of the Involved Entity.
      type: Number
    - contextPath: GoogleSecOps.AlertEntity.entityUri
      description: The full URL of the Involved Entity in the source system.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.sourceSystemUri
      description: The source system URI link of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.additionalProperties
      description: The additional properties of the Involved Entity as a JSON string.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.suspicious
      description: Whether the Involved Entity is considered suspicious.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.internal
      description: Whether the Involved Entity is internal.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.attacker
      description: Whether the Involved Entity represents an attacker.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.pivot
      description: Whether the Involved Entity is a pivot entity common to multiple cases.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.manuallyCreated
      description: Whether the Involved Entity was added manually.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.enriched
      description: Whether the Involved Entity has been enriched by an external action.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.artifact
      description: Whether the Involved Entity is an artifact.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.vulnerable
      description: Whether the Involved Entity is vulnerable.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.displayName
      description: The display name of the context group of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.highlighted
      description: Whether the context group of the Involved Entity is highlighted.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.hidden
      description: Whether the context group of the Involved Entity is hidden.
      type: Boolean
    - contextPath: GoogleSecOps.AlertEntity.fields.items.name
      description: The property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.originalName
      description: The original property name of the context group item of the Involved Entity.
      type: String
    - contextPath: GoogleSecOps.AlertEntity.fields.items.value
      description: The value of the context group item of the Involved Entity.
      type: String
  - arguments:
    - description: Filter the playbooks by environment.
      name: environment
      required: false
    - auto: PREDEFINED
      defaultValue: ALERT
      description: Filter the playbooks attachable by the specified execution scope.
      name: execution_scope
      predefined:
      - ALERT
      - CASE
      - EXECUTION_SCOPE_UNSPECIFIED
      required: false
    description: Retrieve the list of all playbooks that are currently enabled and ready for execution.
    name: gcb-playbook-list
    outputs:
    - contextPath: GoogleSecOps.Playbook.playbookName
      description: The name of the enabled playbook.
      type: String
    - contextPath: GoogleSecOps.Playbook.description
      description: The description of the playbook.
      type: String
    - contextPath: GoogleSecOps.Playbook.playbookType
      description: The type of the playbook (REGULAR or NESTED).
      type: String
    - contextPath: GoogleSecOps.Playbook.originalWorkflowDefinitionIdentifier
      description: The original workflow definition identifier of the playbook.
      type: String
    - contextPath: GoogleSecOps.Playbook.workflowDefinitionIdentifier
      description: The workflow definition identifier of the playbook.
      type: String
    - contextPath: GoogleSecOps.Playbook.isDebugMode
      description: Whether the playbook is running in debug mode.
      type: Boolean
  - arguments:
    - description: "Specify the ID of the case to attach the playbook.\n\nNote: Use gcb-case-list to retrieve case ID."
      name: case_id
      required: true
    - description: "Specify the alert group identifier of the case alert.\n\nNote: Use gcb-case-alert-get to retrieve the alert group identifier."
      name: alert_group_identifier
      required: true
    - description: "Specify the alert identifier of the case alert.\n\nNote: Use gcb-case-alert-get to retrieve the alert identifier."
      name: alert_identifier
      required: true
    - description: "Specify the name of the playbook (workflow) to attach.\n\nNote: Use gcb-playbook-list to retrieve available playbook names."
      name: playbook_name
      required: true
    - description: "Specify the original workflow definition identifier of the playbook.\n\nNote: Use gcb-playbook-list to retrieve the original workflow definition identifier."
      name: original_workflow_definition_identifier
    description: Manually attach (trigger) a specific playbook to a case alert.
    name: gcb-playbook-attach
    outputs:
    - contextPath: GoogleSecOps.PlaybookAttach.caseId
      description: The Case ID the playbook was attached to.
      type: String
    - contextPath: GoogleSecOps.PlaybookAttach.alertGroupIdentifier
      description: The alert group identifier the playbook was attached to.
      type: String
    - contextPath: GoogleSecOps.PlaybookAttach.alertIdentifier
      description: The alert identifier the playbook was attached to.
      type: String
    - contextPath: GoogleSecOps.PlaybookAttach.playbookName
      description: The name of the playbook that was attached.
      type: String
    - contextPath: GoogleSecOps.PlaybookAttach.originalWorkflowDefinitionIdentifier
      description: The original workflow definition identifier of the attached playbook.
      type: String
    - contextPath: GoogleSecOps.PlaybookAttach.success
      description: Whether the playbook was successfully attached to the alert.
      type: Boolean
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/googleapi-python3:1.0.0.11185775
fromversion: 6.10.0
defaultmapperin: 'Google SecOps Cases - Incoming Mapper'
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)