Chronicle Security Operations

This MCP server provides a bridge to Google's Chronicle Security Operations suite, enabling AI assistants to perform security analysis tasks through a standardized interface. Built with Python using the FastMCP framework, it offers tools for searching security events, retrieving alerts, looking up entities (IPs, domains, hashes), listing detection rules, and getting IoC matches. The implementation handles authentication through Google Cloud credentials and supports configurable parameters like time ranges and result limits. It's particularly valuable for security analysts who want to leverage AI assistants for threat hunting, incident investigation, and security monitoring without leaving their conversation interface.