GE SecOps Agent

Warning

One user has reported ~$30/day expense in Spanner and a concern that it is due to the RAG Corpus from this project. I do not see this in my own projects but I am investigating further. In the meantime, please carefully monitor your expenses.

GE SecOps Agent

Deploy security-focused AI agents to Gemini Enterprise with integrated access to SecOps SIEM, SOAR, Google Threat Intelligence, and Security Command Center through the Model Context Protocol (MCP).

Built with Google ADK (Agent Development Kit) and deployed via Vertex AI Reasoning Engine.

Quick Start

Local Development (Recommended for Getting Started)

# Clone and setup
git clone --recurse-submodules https://github.com/googleSandy/ge-secops-agent.git
cd ge-secops-agent

# Configure environment
cp .env.example .env
# Edit .env with your Google Cloud credentials

# Install dependencies
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Run locally with ADK Web
cd soc_agent
GOOGLE_GENAI_USE_VERTEXAI=True \
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json \
GOOGLE_CLOUD_PROJECT=your-project-id \
GOOGLE_CLOUD_LOCATION=us-central1 \
adk web

This opens an interactive web UI at http://localhost:8000 where you can test all features instantly.

Production Deployment

# 1. Verify setup and configure IAM (one-time)
python manage.py vertex verify
python manage.py iam setup

# 2. Deploy to Reasoning Engine
just agent-engine-deploy

# 3. Register with Gemini Enterprise
just gem-ent-register

Run just to see all available commands.

Architecture

flowchart TB
    subgraph GE["Gemini Enterprise"]
        UI["User Interface<br/><i>Conversational UI</i>"]
    end

    subgraph RE["Vertex AI Reasoning Engine (us-central1)"]
        subgraph Orch["SOC Agent Orchestrator"]
            Model["gemini-3.1-pro-preview<br/><i>via global endpoint</i>"]

            subgraph RAG["Direct Tool Access"]
                RAGTool["VertexAiRagRetrieval<br/><i>us-east4</i>"]
                Runbooks["170+ SOC Runbooks<br/>IR Procedures<br/>Security Docs"]
            end

            subgraph Specialists["Sub-Agents"]
                CTI["CTI Researcher<br/><i>gemini-3-flash-preview</i><br/><br/>• Threat Intel<br/>• IOC Analysis<br/>• Threat Actors<br/>• Campaigns"]
                T1["Tier 1 Analyst<br/><i>gemini-3-flash-preview</i><br/><br/>• Alert Triage<br/>• Case Mgmt<br/>• Investigation<br/>• Escalation"]
            end
        end
    end

    subgraph MCP["MCP Security Servers"]
        SIEM["SecOps SIEM<br/><i>UDM Search, Entity Timeline<br/>IOC Prevalence, Alerts</i>"]
        SOAR["SecOps SOAR<br/><i>Case Management<br/>Findings, Collaboration</i>"]
        GTI["GTI<br/><i>IOC Lookup, Threat Actors<br/>Campaigns, MITRE ATT&CK</i>"]
        SCC["SCC<br/><i>Findings, Assets<br/>Compliance</i>"]
    end

    subgraph Cache["GTI Response Cache"]
        CacheTTL["File: 24h | IP: 12h<br/>Domain: 30m | URL: 30m"]
    end

    UI --> Orch
    RAGTool --> Runbooks
    Model --> RAG
    Model --> Specialists
    CTI --> SIEM & SOAR & GTI & SCC
    T1 --> SIEM & SOAR & GTI
    GTI --> Cache

    style GE fill:#4285f4,color:#fff
    style RE fill:#34a853,color:#fff
    style Orch fill:#fbbc04,color:#000
    style RAG fill:#ea4335,color:#fff
    style Specialists fill:#9334e6,color:#fff
    style MCP fill:#185abc,color:#fff
    style Cache fill:#137333,color:#fff

Key Design Decisions:

Orchestrator + Specialists: Single user-facing agent delegates to persona-based specialists
RAG Isolation: VertexAiRagRetrieval on orchestrator only (ADK constraint - cannot coexist with function tools)
MCP Integration: Security tools accessed via Model Context Protocol servers
Response Caching: GTI lookups cached with TTLs optimized by data volatility

Installation

Prerequisites

Python 3.10+
Google Cloud SDK configured
GCP project with billing enabled

Required APIs

gcloud services enable aiplatform.googleapis.com storage.googleapis.com \
  cloudbuild.googleapis.com compute.googleapis.com discoveryengine.googleapis.com

Setup Steps

Clone and configure:

git clone --recurse-submodules https://github.com/googleSandy/ge-secops-agent.git
cd ge-secops-agent
cp .env.example .env
# Edit .env with your configuration

Install dependencies:
```
pip install -r requirements.txt
```

Verify setup and configure IAM:

python manage.py vertex verify
python manage.py iam setup

Deploy:

just agent-engine-deploy
# Save AGENT_ENGINE_RESOURCE_NAME to .env

Register with Gemini Enterprise:
```
just gem-ent-register
```

Configuration

See .env.example for all environment variables. Key variables:

Variable	Description
`GCP_PROJECT_ID`	Google Cloud Project ID
`GCP_PROJECT_NUMBER`	Project number (numeric)
`GCP_LOCATION`	Deployment region (e.g., us-central1)
`GCP_STAGING_BUCKET`	GCS bucket for staging (gs://...)
`CHRONICLE_PROJECT_ID`	SecOps SIEM project
`CHRONICLE_CUSTOMER_ID`	SecOps customer ID
`SOAR_URL`	SOAR platform URL
`SOAR_API_KEY`	SOAR API key
`GTI_API_KEY`	Google Threat Intelligence API key
`RAG_CORPUS_ID`	RAG corpus resource name

Usage

Example Queries

"What's the procedure for handling a ransomware incident?"
"Analyze the APT29 threat actor and their recent campaigns"
"Triage this phishing alert for user john.doe@company.com"
"Hunt for lateral movement using SMB in the last 7 days"
"Check IP 198.51.100.42 reputation and search for related activity"

Common Commands

just agent-engine-deploy      # Deploy agent
just agent-engine-redeploy    # Redeploy existing agent
just gem-ent-register      # Register with Gemini Enterprise
just gem-ent-update        # Update registration
just agent-engine-warmup      # Pre-warm MCP connections
just status                   # Check system status

RAG Corpus Management

just rag-list                 # List all RAG corpora
just rag-create "Security Runbooks"
just rag-info RAG_CORPUS_ID=projects/.../ragCorpora/...
just rag-delete RAG_CORPUS_ID=projects/.../ragCorpora/...

Gemini Enterprise Integration

Important

When creating apps via API/CLI, include --app-type APP_TYPE_INTRANET and --industry-vertical GENERIC for visibility in the Gemini Enterprise UI.

Tip

To view all of your deployed Reasoning Engine (Agent Engine) backend runtimes in the Google Cloud Console (including private, remote A2A specialist agents that are not directly registered in Gemini Enterprise Agent Platform), you can navigate to the Google Cloud Agent Platform Runtimes page: https://console.cloud.google.com/agent-platform/runtimes?project=your-project-id

Create via Console (Recommended):

Navigate to Vertex AI > Search & Conversation > Apps
Click Create App > Select Agent type
Copy App ID to .env as GEM_ENT_APP_ID
Run just gem-ent-register

CLI Reference

justfile	Python CLI
`just agent-engine-list`	`python manage.py agent-engine list`
`just gem-ent-register`	`python manage.py gem-ent register`
`just rag-list`	`python manage.py rag list`
`just status`	`python manage.py workflow status`

Run python manage.py --help for all commands.

Local Development

ADK Web (Recommended)

cd soc_agent
GOOGLE_GENAI_USE_VERTEXAI=True \
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json \
GOOGLE_CLOUD_PROJECT=your-project-id \
GOOGLE_CLOUD_LOCATION=us-central1 \
adk web

Opens http://localhost:8000 with:

Real-time chat with agent
Live tool call visualization
Instant iteration without deployment

Testing MCP Servers

cd mcp-security/server/secops-soar/secops_soar_mcp
uv run server.py

Troubleshooting

Issue	Solution
403/401 Auth Error	`gcloud auth application-default login`
API not enabled	`gcloud services enable aiplatform.googleapis.com`
MCP module missing	`git submodule update --init --recursive`
Agent not in Gemini Enterprise	`just gem-ent-verify` then `just gem-ent-link-agent`
Agent not responding	`gcloud logging tail "resource.type=aiplatform.googleapis.com/ReasoningEngine"`

FAQ

Can I use this without SOAR? Yes. All security tool integrations are optional.

What AI models are supported? Default is gemini-3.1-pro-preview for orchestrator, gemini-3-flash-preview for sub-agents. Configurable in agent.py.

How do I update the agent?

git pull && just agent-engine-redeploy && just gem-ent-update

What are the costs? Vertex AI charges per API call. Security products require separate licensing.

Best Practices

Security: Use Secret Manager for credentials, enable audit logging
Development: Separate dev/staging/prod projects
Operations: Set budget alerts, monitor quotas

Resources

ChatOps Chat App - Background approval actions in Google Chat (DISABLED by default pending redesign; CHATOPS_ENABLED gate)
Google ADK Docs - Agent Development Kit
Vertex AI Docs - Platform documentation
MCP Protocol - Model Context Protocol
SecOps Docs - SIEM documentation
Security Command Center

Support

GitHub Issues - Report bugs or request features
Google Cloud Support - Production issues

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
agent_a2a_cti_researcher		agent_a2a_cti_researcher
agent_a2a_detection_engineer		agent_a2a_detection_engineer
agent_a2a_threat_hunter		agent_a2a_threat_hunter
agent_a2a_tier2		agent_a2a_tier2
agent_soc_manager		agent_soc_manager
docs		docs
evalsets		evalsets
external		external
gce		gce
installation_scripts		installation_scripts
investigations/similarity_reports		investigations/similarity_reports
prompts		prompts
test_agents/soc_triage_agent		test_agents/soc_triage_agent
.env.example		.env.example
.gitignore		.gitignore
.gitmodules		.gitmodules
.pre-commit-config.yaml		.pre-commit-config.yaml
CHANGELOG.md		CHANGELOG.md
GEMINI.md		GEMINI.md
README.md		README.md
agent_deployment.ipynb		agent_deployment.ipynb
docker-compose.yml		docker-compose.yml
inspect_alloydb.py		inspect_alloydb.py
justfile		justfile
manage.py		manage.py
pyproject.toml		pyproject.toml
requirements-dev.txt		requirements-dev.txt
requirements.in		requirements.in
requirements.txt		requirements.txt
run_knowledge_graph_eval.py		run_knowledge_graph_eval.py
setup.py		setup.py
test_adk_evals.py		test_adk_evals.py

Navigation Menu

Repository files navigation

GE SecOps Agent

Table of Contents

Quick Start

Local Development (Recommended for Getting Started)

Production Deployment

Architecture

Installation

Prerequisites

Required APIs

Setup Steps

Configuration

Usage

Example Queries

Common Commands

RAG Corpus Management

Gemini Enterprise Integration

CLI Reference

Local Development

ADK Web (Recommended)

Testing MCP Servers

Troubleshooting

FAQ

Best Practices

Resources

Support

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

GE SecOps Agent

Table of Contents

Quick Start

Local Development (Recommended for Getting Started)

Production Deployment

Architecture

Installation

Prerequisites

Required APIs

Setup Steps

Configuration

Usage

Example Queries

Common Commands

RAG Corpus Management

Gemini Enterprise Integration

CLI Reference

Local Development

ADK Web (Recommended)

Testing MCP Servers

Troubleshooting

FAQ

Best Practices

Resources

Support

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages