google-secops GEMINI.md

Google SecOps Extension

This repository contains the Google SecOps Extension, providing specialized skills and tools for security operations.

This is not an officially supported Google product.

This project is not eligible for the Google Open Source Software Vulnerability Rewards Program.

Overview

This extension packages setup and key security workflows into skills.

Crucially, it automatically configures the Google Cloud Remote MCP Server for SecOps. This means:

• No Local Tools: You don't need to install or manage local Python environments for standard tools.
• Enterprise Ready: Connects directly to Google's managed infrastructure for SecOps.
• Adaptive: While it defaults to the Remote server, it can fallback to local tools if needed.

Prerequisites

1. Install Gemini CLI (Preview):

   npm install -g @google/gemini-cli@preview
   

2. Google Cloud Authentication: Ensure you are authenticated with Google Cloud and have set a quota project:

   gcloud auth application-default login
   gcloud auth application-default set-quota-project <YOUR_PROJECT_ID>
   

3. Enable MCP Service: You must enable the Chronicle MCP service in your Google Cloud project:

   gcloud beta services mcp enable chronicle.googleapis.com/mcp --project=<YOUR_PROJECT_ID>
   

4. GUI Login Requirement: You MUST have logged into the Google SecOps GUI at least once before using the API/MCP server.

5. Enable Skills: Ensure your ~/.gemini/settings.json has experimental.skills enabled:

   {
     "security": {
       "auth": {
         "selectedType": "gemini-api-key"
       }
     },
     "general": {
       "previewFeatures": true
     },
     "experimental": {
       "skills": true,
       "extensionConfig": true
     }
   }