Skip to content

Adding feature to update rules in place rather than having to only create new ones#253

Open
Pavornoc wants to merge 1 commit into
google:mainfrom
Pavornoc:feat/add_update_rule_ability
Open

Adding feature to update rules in place rather than having to only create new ones#253
Pavornoc wants to merge 1 commit into
google:mainfrom
Pavornoc:feat/add_update_rule_ability

Conversation

@Pavornoc
Copy link
Copy Markdown

@Pavornoc Pavornoc commented May 7, 2026

Summary

Adds an update_rule MCP tool to the SecOps server, filling a gap in the existing
rule management workflow.

Currently, the only way to modify an existing YARA-L detection rule via MCP is to
create a new rule and manually clean up the old version. update_rule wraps the
existing chronicle.update_rule() client method (PATCH rules/{rule_id} with
update_mask=text) to replace rule text in place, preserving the rule's ID,
deployment state, and version history.

Changes

  • server/secops/secops_mcp/tools/security_rules.py — new update_rule tool,
    inserted after create_rule. No existing code modified.
  • server/secops/tests/test_secops_rules_unit.py — new unit test file with 9 tests
    covering the success path, correct argument forwarding, version string surfacing,
    graceful handling of missing API fields, and error propagation.

Notes

  • The underlying secops library already exposes ChronicleClient.update_rule(rule_id, rule_text);
    this PR only adds the MCP tool layer.
  • The rule name parser in the response message uses the same replace("rule ", "")
    approach as create_rule for consistency. A fix to both functions would be a
    separate follow-on.

@Pavornoc Pavornoc requested a review from a team May 7, 2026 20:52
@google-cla
Copy link
Copy Markdown

google-cla Bot commented May 7, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant