feat(integrations): add Google SecOps SOAR integration #1814
+865
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (all 1 issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="packages/tracecat-registry/tracecat_registry/integrations/google_secops_soar.py">
<violation number="1" location="packages/tracecat-registry/tracecat_registry/integrations/google_secops_soar.py:47">
P2: Returning an empty string when `GOOGLE_SECOPS_BASE_URL` is not configured will cause confusing HTTP errors (requests to relative URLs like `/search/CaseSearchEverything`). Consider raising a descriptive error instead, similar to other integrations like splunk.py.</violation>
</file>
Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR
packages/tracecat-registry/tracecat_registry/integrations/google_secops_soar.py
Outdated
Show resolved
Hide resolved
topher-lo
requested changes
Dec 21, 2025
packages/tracecat-registry/tracecat_registry/integrations/google_secops_soar.py
Outdated
Show resolved
Hide resolved
- Remove GOOGLE_SECOPS_BASE_URL from secrets - base_url is now a required function argument - Update secret docstring to only include API key - Return original API payload instead of custom success messages - Handle 204 No Content responses properly
Contributor
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="packages/tracecat-registry/tracecat_registry/integrations/google_secops_soar.py">
<violation number="1" location="packages/tracecat-registry/tracecat_registry/integrations/google_secops_soar.py:238">
P2: Missing 204/no-content check that was added to other similar functions in this PR. If the API returns 204 No Content or empty body, `response.json()` will raise a `JSONDecodeError`. Add the same defensive check used in the other modified functions.</violation>
</file>
Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR
packages/tracecat-registry/tracecat_registry/integrations/google_secops_soar.py
Show resolved
Hide resolved
Add defensive check for 204 No Content and empty body responses to all remaining functions to prevent JSONDecodeError
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Adds Google SecOps (Chronicle) SOAR integration for security case management automation.
Changes
Functions Included
search_casesadd_case_tagassign_user_to_casechange_case_stageupdate_case_priorityupdate_alert_prioritycreate_case_commentupdate_case_commentclose_alertreopen_alertbulk_close_casesAuthentication
Uses API key authentication via
AppKeyheader.Required secrets:
GOOGLE_SECOPS_API_KEY,GOOGLE_SECOPS_BASE_URLUse Cases
Breaking Changes
None - This is a new integration.
Checklist
Summary by cubic
Adds Google SecOps (Chronicle) SOAR integration to automate case and alert workflows in Tracecat. Provides 11 UDFs and a new icon, covering search, lifecycle updates, comments, and bulk actions.
New Features
Migration
Written for commit 2495932. Summary will update automatically on new commits.