feat(secops): add comprehensive SOAR parity tools for Chronicle 1P (Git Stack 2/2)

[dandye]

Overview

Note

Git Stack: This pull request is Part 2 of a 2-part stack:

1. Part 1 (Base): PR feat(secops): add Chronicle 1P Case and Case Alert Management MCP tools #282 (soar_trigger) - Chronicle 1P Case and Case Alert Management MCP tools with SOAR reaction trigger support.
2. Part 2 (This PR): PR on branch soar_parity (target base: soar_trigger) - Full SOAR parity across Case Comments, Telemetry Event Forensics, Entity Investigation, Integrations & Action Execution, Playbooks, and Connector Events.

This PR brings complete feature parity between the Google SecOps 1P MCP server (server/secops) and the standalone legacy secops-soar / Remote SecOps MCP (google.cloud.chronicle.mcp_tools), while introducing optimizations such as single-call multi-resource parallel fetching.

---

New Tools & Modules Added

1. Case Management & Consolidated Investigation (case_management.py)

• list_case_comments: Retrieves paginated case comments and discussion notes with filtering and ordering.
• create_case_comment / post_case_comment: Creates structured analyst notes and comments on a case.
• get_case_full_details: Single-call parallel fetch (asyncio.gather) aggregating case metadata, security alerts, and comment timelines for an instant 360-degree triage view.

2. Alert Grouping & Raw Event Forensics (case_alert_management.py)

• list_alert_group_identifiers_by_case: Lists alert group identifiers used for correlation and playbook targeting.
• list_events_by_alert / list_involved_events: Fetches underlying raw/UDM events backing a specific alert for forensic verification.

3. Entity Investigation & Discovery (entity_investigation.py)

• get_involved_entity: Retrieves properties, enrichments, and flags of an entity involved in an alert.
• list_involved_entities: Lists all involved entities across an alert or case.
• get_entities_by_alert_group_identifiers: Retrieves involved entities for specific alert group identifiers.
• get_entity_details: Retrieves full unique entity details and enrichments in the SOAR platform.
• search_entity: Flexible entity search filtering on term, entity types, is_suspicious, is_internal_asset, is_enriched, network, and environment.

4. Integrations & Action Execution (integration_management.py)

• list_integrations: Discovers configured integrations (EDR, Firewall, SIEM, TI, Ticketing).
• list_integration_actions: Lists available executable actions for a specific integration or across all integrations.
• list_integration_instances: Lists configured integration instances and retrieves instance GUIDs.
• execute_manual_action: Executes manual actions/scripts (e.g. host isolation, IP blocking, enrichment) on cases, alerts, or entities.
• get_action_result_by_id: Retrieves status and output logs of asynchronous action executions.

5. Playbook Management & Lifecycle (playbook_management.py)

• list_playbooks: Lists configured automated playbooks with type filters (REGULAR, NESTED).
• get_playbook: Fetches detailed playbook configuration, triggers, and steps.
• list_playbook_instances: Lists historical and active playbook execution runs for a case or alert.
• execute_playbook / trigger_playbook: Manually triggers a playbook workflow on a case or alert.

6. Connector Events (connector_event_management.py)

• list_connector_events: Lists raw connector events ingested through SOAR connectors.
• get_connector_event: Retrieves connector event details.

---

Security & Secret Scanning

• Scanned repository diff and untracked files for API keys, bearer tokens, passwords, private keys, and credentials: 0 secrets found.

---

Verification & Testing

• Unit tests added in server/secops/tests/test_secops_soar_parity.py.
• Full test suite verified:

  python3 -m unittest tests.test_secops_case_management tests.test_secops_soar_parity
  # Ran 22 tests in 0.033s. OK