---
id: secops
version: "0.44.1"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# secops — Python SDK for wrapping the Google SecOps API for common use cases

License: permissive · Maintenance: active · Downloads: 279.0K/mo

## What it is and what it does

The secops package is a Python wrapper around the Google Security Operations (Chronicle) API, designed to simplify interaction with Google's SIEM platform. It abstracts away low-level API details and provides a client-based interface for common security operations workflows: searching Unified Data Model (UDM) events, looking up entities, managing indicators of compromise, handling alerts, managing cases, and administering detection rules. The SDK supports multiple authentication methods—Application Default Credentials for local development and cloud environments, explicit service account files, and service account impersonation—making it flexible for different deployment scenarios.

The package depends on google-api-python-client, google-auth-httplib2, and google-auth to handle API communication and credential management. It includes built-in retry logic for transient failures and a command-line interface for terminal-based operations. The SDK is actively maintained, supports Python 3.10 through 3.13, and carries an Apache-2.0 license. Setup requires a pre-configured Google Cloud project linked to your SecOps instance and appropriate IAM roles; without this infrastructure, authentication will fail regardless of SDK installation.

Use it for:

- Automate UDM event searches and threat hunting workflows within Chronicle without writing raw API calls.
- Build security orchestration scripts that query entities, manage alerts, and update cases programmatically.
- Integrate Chronicle SIEM data into custom dashboards or incident response automation platforms.
- Manage detection rules and IoC indicators at scale via Python scripts or scheduled jobs.
- Develop CLI tools or terminal-based security operations workflows using the built-in command interface.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

A Python SDK for interacting with Google Security Operations (Chronicle/SecOps) SIEM, wrapping the API to support UDM searches, entity lookups, IoCs, alert management, case management, and detection rule management.

Yes, if you are already using Google Security Operations (Chronicle) and need programmatic access from Python. The low install friction, active maintenance, permissive license, and comprehensive authentication options make it a practical choice for integrating Chronicle into automation and orchestration workflows. The alpha status and requirement for pre-configured Google Cloud infrastructure are not blockers for teams already committed to the Chronicle platform.

## Install

pip install secops
uv add secops
poetry add secops

## Installing secops

Before you install: Low install friction with a pure-Python wheel. Actively maintained as of 2026-07-22 with recent releases; marked alpha status but in the top 15000 PyPI packages by downloads. Depends on three Google authentication and API client libraries.

License in practice: Licensed under Apache-2.0 (permissive), allowing use in commercial and proprietary projects with minimal restrictions beyond attribution.

Quickstart:

pip install secops

from secops import SecOpsClient

client = SecOpsClient()
chronicle = client.chronicle(
    customer_id="your-instance-id",
    project_id="your-project-id",
    region="us"
)

Requires a Google Cloud project linked to a Google SecOps instance, Chronicle API enabled, and appropriate IAM permissions (Chronicle API Admin role recommended). Authentication via Application Default Credentials or explicit service account credentials is mandatory.

Verify before relying:

- Whether the SDK supports all Chronicle API endpoints or only a subset of common use cases.
- Performance characteristics and rate-limiting behavior under high-volume query loads.
- Backward compatibility guarantees given alpha status (Development Status :: 3).

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 279.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

google chronicle siem api, secops python sdk, google security operations client, chronicle udm search, security alert management api, google cloud security api wrapper, siem integration python, siem-integration, google-cloud, threat-hunting

[View on SkillFed](https://skillfed.io/packages/secops) · [View on PyPI](https://pypi.org/project/secops/)