How to check Detailed Audit Logs for SOAR Playbooks

[skadav]

I'm trying to access detailed audit logs specifically for SOAR Playbooks. Currently, I can view the audit logs for SIEM rules using metadata.product_name = "Google Cloud Platform", but I'm unable to locate similar logs for SOAR Playbooks.

Has anyone managed to find or configure audit logging specifically for SOAR Playbooks? 

[dnehoda]

SOAR has the audit logs under SOAR Settings, Advanced, Audit.  

You can see from an inspection that it is calling /api/external/v1/settings/ExportAuditLastWeekAsCsvV2 

THere's no direct way to do it right now.  You could probably piece together a clunky way to do it with a CSV export and then use ingest API to get the data. 

I'm questioning the value to do something like this - what would you do with that data if it was in SIEM?

[skadav]

@dnehoda  Yes it has under Audit and can be exported as CSV, but if it is searchable like SIEM Audit logs, we can track the playbook run/error efficiently.

[TonyH]

Hello,

I believe the ability to search SOAR logs (including playbooks) in Google Cloud logging is coming. Unfortunately we don't have a firm date as of yet. 

[dnehoda]

It is coming but I don't believe until next year toward end of Q1.