The Google Cloud Security Community will be in read-only mode July 16 - July 22 as we migrate platforms. Read more and check out our FAQ.

[GCSCommunity]

Table of Contents

• Table of Contents
• Prerequisites
• Actions
• Marketplace Use-Cases
• Marketplace Integrations
• Marketplace Power-Ups

The Google SecOps Marketplace offers a central hub where you can access a wealth of pre-built integrations, community-developed playbooks, and powerful analytics – all designed to streamline your Security Operations Center (SOC) workflows and supercharge your incident response.

The Marketplace empowers you to seamlessly connect Google SecOps with leading security tools, automate repetitive tasks with pre-built playbooks, and gain invaluable insights from comprehensive dashboards. This collaborative environment fosters innovation, saves valuable time, and allows your SOC team to focus on what matters most – effectively combating cyber threats.

Prerequisites

• Entitlement for Google SecOps on the account and project.
• Administrative access to Google SecOps.
• Administrative access for any 3rd party applications that are intended to be connected to Google SecOps

Actions

Marketplace Use-Cases

The Google SecOps Marketplace acts as the customer's toolbox, holding a wide range of utilities and options to choose from. The Marketplace also contains a repository for predefined Use Cases, Power Ups that enhance Playbook capabilities, and Analytics that provide valuable insights.

Show More

Steps

1. To begin users will go to the left-side Navigation Bar and then select Marketplace, that will display the Google SecOps Marketplace page. 
2. Users will also see three tabs to select from, consisting of:
   1. Use Cases
   2. Integrations
   3. Power Ups
3. Users will select the Use Cases tab, which will display many pre-defined Use Cases at the bottom of the page.
4. In the Marketplace page, users will see a Search bar at the top-right of the page, to Search for Use Cases.
5. Users will have the option to Filter the category types of Use Cases they want to display at the center of the page.
6. These categories consist of:
   1. Malware
   2. Endpoint
   3. Threat Hunting
   4. Investigation
   5. Threat Intelligence
   6. Insider Threat
   7. …and more
7. To the right of Filters is a Use Case Option menu, which will give the user a choice to:
   1. Create New Use Case
   2. Import Use Case
   3. Export Use Case
   4. Refresh
      
8.  Once a user has found a Use Case to Install, they will select the Use Case, by clicking Install.
9. A popup window will appear, which will display the Use Case with five steps:
   1. Use Case Information
   2. Use Case Items
   3. Install Use Case Items
   4. Configure Integrations
   5. Run Use Case
10. Typically the Use Case Information section will display a video from Google SecOps that will give users a basic overview with and step-by-step instructions on how to install and run the Use Case.
11. On the same page, users will see a description and three to four dropdowns that will display:
    1. Playbooks
    2. Integrations
    3. Test Cases
    4. Connectors
12. Users will select Next.
13. Users will see the Use Case Items page, that will show Install Use Case Items at the top of the page. Here users will be able to:
    1. Install Integrations
    2. Install Playbooks
    3. Install Simulation Cases
14. Users will have a Search function in section and an option to Override existing Ontology.
15. Users will select Install to Install the Use Case items. Once the Installation is completed, it will display Installation Completed, with all of the Integrations, Playbooks, and Simulation Cases installed.  Then select Next.
16. Users will see the Configure Integrations page, listing all of the Integrations. Each Integration will have the following fields to Configure:
    1. Instance
    2. Environment
    3. Instance Name
    4. Description
    5. Parameters
    6. API Key
    7. Verify SSL
17. Users will then have the option to Test and Save each Integration.
18. When complete, users will select Next.
19. In the Run Use Case page, users will see an option to Select Alert for Simulation by selecting the checkbox next to the Use Case and select Next.
20.  Once selected users will see a Congratulations message and the Next Steps to:
    1. Simulate More Alerts
    2. To Connect Your Data
    3. Connect your Remote Environment
21. Users will select Finish.

Relevant Documentation Links

• [All Steps] https://cloud.google.com/chronicle/docs/soar/marketplace/run-use-cases
  

Use Case Example

1. Here is an example of how to install and configure the Use Case “Phishing Use Case - Zero to Hero”:
2. Users will select the Marketplace on the left Navigation Bar. 
3. Select Use Case tab on the Google Marketplace page. 
4. In the pre-defined Use Cases below, select from the Community-version “Phishing Use Case - Zero to Hero” and click Install.
5. After watching the Guide Video in the Use Case Information section, users will see the Playbooks, Integrations, Test Cases, and Connectors associated with the Use Case, and select Next. 
6. In the Use Case Items section, users will see the Integrations, Playbooks, and Simulations Cases that will be Installed. If there is a conflict with an existing Ontology, and the user chooses to Override, they will select the box next to Override Existing Ontology. Once complete, users will then select Install. 

7.  Once Installed, users will see that their Installation is complete, and will select Next.

   
8. Once users Configure their Integration, they can Test and Save the Configuration, then select Next. 
9. In the Run Use Case section, users will select the Alert for Simulation, by selecting the checkbox next to the Use Case, then select Next. 
10. In the final step, once the Use Case is deployed, users will see instructions on Next Steps and how to navigate to the Cases screen to see the simulations in action. Once done, select Finish. 

Marketplace Integrations

The Google SecOps Marketplace acts as the customer's toolbox, holding a wide range of utilities and options to choose from. The Marketplace also contains a repository for predefined Use Cases, Power Ups that enhance Playbook capabilities, and Analytics that provide valuable insights.

Show More

Steps

1. To begin users will go to the left-side Navigation Bar and then select Marketplace, that will display the Google SecOps Marketplace page. 
2. Users will also see three tabs to select from, consisting of:
   1. Use Cases
   2. Integrations
   3. Power Ups
3. In the Marketplace page, users will see a Search bar at the top-right of the page, to Search for Integrations.
4. Users will select Integrations, which will display many pre-defined Integrations at the bottom of the page.
5. Users will have the option to Filter the category types of Integrations they want to display at the center of the page. 
6. These categories consist of:
   1. Security
   2. Threat Intelligence
   3. IT & Infrastructure
   4. Access Management
   5. IAM
   6. …and more
7. At the top of the page are two dropdown menus:
   1. Type
   2. Status
8. In the Type menu, users can select from the following Integrations:
   1. All Integrations
   2. Google SecOps Integrations
   3. Published by Community
   4. Custom Integrations
9. In the Status menu, users can select Integrations that are:
   1. Installed
   2. Not Installed
   3. Available Upgrade
10. Users can read the Details of each Integration by selecting the Details button.
11. Once a user has found an Integration to Install, they will select the Integration, by clicking Install.
12.  Users will see a popup showing the Integration is complete.
13. Once an Integration is complete, users will see that the Install button has be replaced with a Configure button. User will select Configure. 
14. A Configure Instance popup will appear, that will display the following fields:
    1. Environment
    2. Instance Name
    3. Description
    4. Parameters
    5. API Key
    6. Verify SSL
15. Users will have the option to Test the Instance, by selecting the Test button.
16. Once complete, users will select Save.
17. Note: Users can make changes at a later stage if needed. Once configured, the instances can be used in Playbooks.

Relevant Documentation Links

• [All Steps] https://cloud.google.com/chronicle/docs/soar/respond/integrations-setup/configure-integrations

Marketplace Power-Ups

The Google SecOps Marketplace acts as the customer's toolbox, holding a wide range of utilities and options to choose from. The Marketplace also contains a repository for predefined Use Cases, Power Ups that enhance Playbook capabilities, and Analytics that provide valuable insights.

Show More

Steps

1. To begin users will go to the left-side Navigation Bar and then select Marketplace, that will display the Google SecOps Marketplace page. 
2. Users will also see three tabs to select from, consisting of:
   1. Use Cases
   2. Integrations
   3. Power Ups
3. In the Marketplace page, users will see a Search bar at the top-right of the page, to Search for Power Ups.
4. Users will select Power Ups, which will display many pre-defined Power Ups at the bottom of the page.
5. Users will have the option to filter the list of Power Ups by selecting by Status, using the following options:
   1. Installed
   2. Not Installed
   3. Available Upgrade
6. Users can read the Details of each Power Up by selecting the Details button.
7. Once a user has found an Power Up to Install, they will select the Power Up, by clicking Install.
8.  Users will see a popup showing the Integration is complete.
9. Once an Power Up is complete, users will see that the Install button has be replaced with a Configure button. User will select Configure.
10. A Configure Instance popup will appear, that will display the following fields:
    1. Environment
    2. Instance Name
    3. Description
11. Users will have the option to Test the Instance, by selecting the Test button. 
12. Once complete, users will select Save.

Relevant Documentation Links

• [All Steps] https://cloud.google.com/chronicle/docs/soar/marketplace/using-the-marketplace

Next Step: Security Operations: Step 3 - Detect 

Previous Step: Security Operations: Step 2.1 - Ingestion | Configure Data Ingest