fix(secops): include alert IDs and verdicts

[rioyu123]

Summary

• include Chronicle alert IDs and verdicts in get_security_alerts output
• keep the existing response shape and status/severity fallback behavior
• cover nested and direct-list responses, malformed feedback summaries, and unspecified verdicts

The alert ID is needed to chain list results into the detail and update tools, while the verdict makes the list useful for triage analysis.

Fixes #266

Tests

• uv run --extra test --with mcp[cli]<2 pytest tests/test_security_alerts_unit.py tests/test_secops_tools_unit.py -q (15 passed)
• uvx ruff check tests/test_security_alerts_unit.py
• uvx ruff format --check tests/test_security_alerts_unit.py

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[dandye]

Thank you for this PR. Adding alert_id and verdict to get_security_alerts is a great improvement.

Before merging, please address the following logic issue regarding how feedbackSummary fallback is handled:

The Issue

In security_alerts.py:

feedback_summary = alert.get('feedbackSummary')
has_feedback_summary = isinstance(feedback_summary, dict)
if not has_feedback_summary:
    feedback_summary = {}

status = 'Unknown'
if has_feedback_summary:
    status = feedback_summary.get('status', 'Unknown')
elif 'status' in alert:
    status = alert.get('status', 'Unknown')

When an alert has not yet received triage feedback overrides, Chronicle returns feedbackSummary: {} (an empty dictionary). In this case:

1. isinstance(feedback_summary, dict) evaluates to True, setting has_feedback_summary = True.
2. feedback_summary.get('status', 'Unknown') returns 'Unknown'.
3. The elif 'status' in alert: branch is skipped.
4. As a result, the root alert fields (alert['status'] = "OPEN", alert['severity'] = "Medium") are discarded and overwritten with 'Unknown'.

Requested Fix

Please replace the branching logic with standard fallback chaining so that non-empty feedbackSummary values take precedence, while cleanly falling back to the root alert fields when feedbackSummary is empty ({}) or None:

alert_id = alert.get('id')
feedback_summary = alert.get('feedbackSummary') if isinstance(alert.get('feedbackSummary'), dict) else {}

status = feedback_summary.get('status') or alert.get('status') or 'Unknown'
verdict = feedback_summary.get('verdict') or alert.get('verdict') or 'Unknown'
severity = feedback_summary.get('severityDisplay') or alert.get('severity') or 'Unknown'

Unit Test Update

Please update test_get_security_alerts_keeps_empty_feedback_summary_authoritative in tests/test_security_alerts_unit.py so that an alert with feedbackSummary: {} preserves the root status: "OPEN" and severity: "Medium" rather than expecting 'Unknown'.

Once these changes are updated, we will be ready to merge this PR.

[rioyu123]

Thanks for catching this. Updated in a7ae023.

feedbackSummary now takes precedence per field when it provides a non-empty value, while empty or missing values fall back to the root status, verdict, and severity. The empty-summary regression now verifies that OPEN, FALSE_POSITIVE, and Medium are preserved.

Verified with the focused alert tests and the related SecOps unit-test set (22 passed).