Cline rules

1# Suggested New MCP Tools
2 
3Based on the current toolsets for SecOps (SIEM), SOAR, GTI, and SCC, and considering the workflows outlined in the runbooks and personas, here are some potential new MCP tools that could significantly enhance the agent's (and analysts') capabilities:
4 
5**1. SecOps MCP (`secops-mcp` - Chronicle SIEM Direct Interaction):**
6 
7*   **Rule Management Suite:**
8    *   `create_detection_rule`: To programmatically create new detection rules (e.g., YARA-L) based on investigation findings or threat intelligence. (Supports Security Engineer/Tier 3 Analyst).
9    *   `update_detection_rule`: To modify existing rules (e.g., tuning logic, adjusting thresholds).
10    *   `enable_detection_rule` / `disable_detection_rule`: To manage the active state of rules.
11    *   `get_rule_version_history`: To track changes made to a specific rule.
12*   **Reference List Management Suite:**
13    *   `add_to_reference_list`: Direct SIEM interaction to add items (IPs, domains, hashes) to a specified list (complementing the SOAR action).
14    *   `remove_from_reference_list`: Direct SIEM interaction to remove items.
15    *   `get_reference_list_contents`: To retrieve all items currently in a specific reference list for verification or analysis.
16*   **Retrohunt Management Suite:**
17    *   `start_retrohunt`: To initiate a retrohunt based on a rule ID or YARA-L content over a specified time range.
18    *   `get_retrohunt_status`: To check the progress of an ongoing retrohunt.
19    *   `get_retrohunt_results`: To retrieve the findings of a completed retrohunt.
20*   **Enhanced Context Tools:**
21    *   `get_asset_details`: Retrieve comprehensive asset information directly from Chronicle's asset model (beyond basic `lookup_entity`).
22    *   `get_user_details`: Retrieve comprehensive user information directly from Chronicle's user model.
23*   **UDM Query Helper:**
24    *   `validate_udm_query`: Check the syntax and field validity of a UDM query before execution.
25    *   `suggest_udm_fields`: Based on keywords or event types, suggest relevant UDM fields for querying.
26 
27**2. SOAR MCP (`secops-soar` - Chronicle SOAR Orchestration):**
28 
29*   **Playbook Management Suite:**
30    *   `list_playbooks`: List available SOAR playbooks.
31    *   `get_playbook_details`: Retrieve the definition or steps of a specific playbook.
32    *   `trigger_playbook`: Manually trigger a specific playbook for a case or alert.
33    *   `get_playbook_run_status`: Check the status and step execution of an active playbook instance.
34*   **Integration Management:**
35    *   `list_soar_integrations`: List configured integrations within the SOAR platform.
36    *   `test_soar_integration`: Run a connectivity test for a specific integration.
37*   **Enhanced Attachment Handling:**
38    *   `get_case_attachments`: List or retrieve files attached to a SOAR case.
39    *   `add_attachment_from_content`: Allow attaching content directly (e.g., report text generated by the agent) without needing a pre-existing file path.
40*   **Advanced Case Linking:**
41    *   `find_related_cases`: Search for other SOAR cases explicitly linked by shared entities (IP, hash, user), alerts, or IOCs beyond the standard similarity check.
42 
43**3. GTI MCP (`gti-mcp` - Google Threat Intelligence):**
44 
45*   **Bulk Enrichment Suite:**
46    *   `bulk_get_ip_reports`: Input a list of IP addresses, get back a list of corresponding reports.
47    *   `bulk_get_domain_reports`: Similar for domains.
48    *   `bulk_get_file_reports`: Similar for file hashes.
49*   **Rule Generation Helper:**
50    *   `generate_yara_from_hash`: Suggest YARA rules based on analysis of a given file hash.
51    *   `generate_yara_from_family`: Suggest YARA rules based on a known malware family report/collection.
52*   **Threat Profile Management:**
53    *   `create_threat_profile`: Programmatically create a new threat profile.
54    *   `update_threat_profile`: Modify settings (regions, industries) or followed items for a profile.
55    *   `follow_collection_in_profile`: Add a specific collection (actor, malware) to a threat profile.
56*   **Direct Submission:**
57    *   `submit_url_for_analysis`: Submit a URL to GTI for scanning/analysis.
58    *   `submit_hash_for_information`: Request information on a hash even if a full report isn't immediately available (check if seen/submitted).
59 
60**4. SCC MCP (`scc-mcp` - Security Command Center):**
61 
62*   **Generic Finding Search:**
63    *   `search_scc_findings`: A flexible tool to search findings with filters for category, severity, state, resource type, project ID, time range, etc.
64*   **Finding State Management:**
65    *   `mute_scc_finding`: Mute a specific finding with a reason.
66    *   `unmute_scc_finding`: Unmute a finding.
67    *   `update_finding_state`: Change the state of a finding (e.g., to `FIXED`).
68*   **Asset Inventory:**
69    *   `list_scc_assets`: Query SCC's view of cloud assets, with filtering by type, project, labels, etc.
70*   **Security Marks Management:**
71    *   `add_security_marks`: Add key-value marks to findings or assets.
72    *   `update_security_marks`: Modify existing marks.
73*   **Posture Details:**
74    *   `get_posture_details`: Query the status or configuration of specific Security Health Analytics detectors or compliance standards.
75 
76These suggested tools aim to fill gaps in automation, provide deeper context, enable more direct management of security configurations (like rules and lists), and streamline common analyst workflows identified in the runbooks.
77