secops

What it is and what it does

The secops package is a Python wrapper around the Google Security Operations (Chronicle) API, designed to simplify interaction with Google's SIEM platform. It abstracts away low-level API details and provides a client-based interface for common security operations workflows: searching Unified Data Model (UDM) events, looking up entities, managing indicators of compromise, handling alerts, managing cases, and administering detection rules. The SDK supports multiple authentication methods—Application Default Credentials for local development and cloud environments, explicit service account files, and service account impersonation—making it flexible for different deployment scenarios.

The package depends on google-api-python-client, google-auth-httplib2, and google-auth to handle API communication and credential management. It includes built-in retry logic for transient failures and a command-line interface for terminal-based operations. The SDK is actively maintained, supports Python 3.10 through 3.13, and carries an Apache-2.0 license. Setup requires a pre-configured Google Cloud project linked to your SecOps instance and appropriate IAM roles; without this infrastructure, authentication will fail regardless of SDK installation.

Use it for:

• Automate UDM event searches and threat hunting workflows within Chronicle without writing raw API calls.
• Build security orchestration scripts that query entities, manage alerts, and update cases programmatically.
• Integrate Chronicle SIEM data into custom dashboards or incident response automation platforms.
• Manage detection rules and IoC indicators at scale via Python scripts or scheduled jobs.
• Develop CLI tools or terminal-based security operations workflows using the built-in command interface.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A Python SDK for interacting with Google Security Operations (Chronicle/SecOps) SIEM, wrapping the API to support UDM searches, entity lookups, IoCs, alert management, case management, and detection rule management.

Yes, if you are already using Google Security Operations (Chronicle) and need programmatic access from Python. The low install friction, active maintenance, permissive license, and comprehensive authentication options make it a practical choice for integrating Chronicle into automation and orchestration workflows. The alpha status and requirement for pre-configured Google Cloud infrastructure are not blockers for teams already committed to the Chronicle platform.

Install

secops on PyPI

pip install secops

uv add secops

poetry add secops

Installing secops

Before you install

Low install friction with a pure-Python wheel. Actively maintained as of 2026-07-22 with recent releases; marked alpha status but in the top 15000 PyPI packages by downloads. Depends on three Google authentication and API client libraries.

License in practice

Licensed under Apache-2.0 (permissive), allowing use in commercial and proprietary projects with minimal restrictions beyond attribution.

Quickstart

pip install secops

from secops import SecOpsClient

client = SecOpsClient()
chronicle = client.chronicle(
    customer_id="your-instance-id",
    project_id="your-project-id",
    region="us"
)

Requires a Google Cloud project linked to a Google SecOps instance, Chronicle API enabled, and appropriate IAM permissions (Chronicle API Admin role recommended). Authentication via Application Default Credentials or explicit service account credentials is mandatory.

Verify before relying

• Whether the SDK supports all Chronicle API endpoints or only a subset of common use cases.
• Performance characteristics and rate-limiting behavior under high-volume query loads.
• Backward compatibility guarantees given alpha status (Development Status :: 3).

Package facts

Evidence: secops-0.44.1-py3-none-any.whl

Keywords: chronicle, google, secops, security

Tags

More Security packages