Skip to content

Conversation

@mihirvala08
Copy link
Collaborator

Summary

Added Watchlist Management tools to SecOps MCP for Chronicle SIEM, enabling AI-assisted entity risk scoring and watchlist lifecycle management.

What

Added 5 Chronicle SIEM Watchlist Management tools:

  • create_watchlist - Create new watchlist with risk multiplier
  • update_watchlist - Update watchlist properties (display name, description, risk multiplier, entity population mechanism, user preferences)
  • delete_watchlist - Delete watchlist by ID with force option
  • get_watchlist - Retrieve watchlist details and configuration
  • list_watchlists - List all watchlists with pagination support

Changelog

  • server/secops/secops_mcp/tools/watchlist_management.py: Added watchlist management tools for creating, updating, deleting, retrieving, and listing watchlists with comprehensive documentation and error handling
  • server/secops/secops_mcp/tools/__init__.py Added import for watchlist management tools
  • server/secops/tests/test_secops_watchlist_mcp.py: Integration tests for watchlist management tools covering full lifecycle (create, update, delete) and read operations (list, get) with real Chronicle API calls

Testing

  • 4 integration test methods covering all 5 tools
  • Full lifecycle test with create → update → delete workflow
  • Cleanup logic in finally blocks to prevent test data pollution
  • Skips gracefully when no watchlists available

@mihirvala08 mihirvala08 marked this pull request as ready for review January 22, 2026 12:02
@mihirvala08 mihirvala08 requested a review from a team January 22, 2026 12:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant