SecOps Platform Theme became light

[JuLenny]

Hi,

A couple of days ago, the theme of our SIEM/SOAR became light and in some screens (like Rules & Detections), it's masking the text. I want to make it dark blue again, but unlike the independent Chronicle SOAR, where it's configurable when clicking on the user icon, I can't find the option to switch themes.

Does anyone know where that option is hidden?

Thanks

[ajohnson · Accepted solution]

This might be a bug with the SOAR update for version 6.3.23.2 that came out on 11/2: 

https://cloud.google.com/chronicle/docs/soar/release-notes#November_02_2024

If you go to SOAR Settings > License Management, then in the top right under system version does it show: 6.3.23.2? 

I looked at 2 of our unified tenants, have one tenant on this version that is exactly how you describe and another with the lack of availability to choose themes but is in "dark mode". 

Version 6.3.24 is currently in Preview so i would assume it will be GA next week, but might be worth a GCP Support Case/Reaching out to your CE on this (will be doing the same).

Both unified SecOps only have "localization" under the profile icon while the legacy SOAR still has themes, localization, sign out, and change password. 

[JuLenny]

Hi @ajohnson 

Thanks for clarifying on this. Indeed, we use version 6.3.23.2.

I'll open a support case on this.

[ajohnson]

Yea I dug through SIEM + SOAR settings and couldn't find anything either. I noticed some additional changes that were not documented in the release notes that might be causing other issues with unified SecOps so i created a support ticket and will chase with our PE tomorrow too. 

But recommend creating that support case on your side as well to increase priority with support. 

[ajohnson]

Well support finally closed my case, they are saying that it only supports dark theme and logout is predetermined now. Definitely was not that way before: 

We have an below update from the engineering team.

1. SecOps only supports dark theme. There are future plans to support light theme, but no ETA.
2. Currently logout is set to 3 hours. We are working on a logout functionality.

Your requirement has been requested as a feature request. The request has been forwarded to the Chronicle SOAR engineering team so they may evaluate. There is no timeline or implementation guarantee for the feature request yet; however, you can check the progress on the feature by creating a new case referring to the following ID: 379667935.