The Google Cloud Security Community will be in read-only mode July 16 - July 22 as we migrate platforms. Read more and check out our FAQ.

[elirazo]

Hi Team,
I'm exploring options to automate the execution of a PowerShell script using variables extracted from a SecOps alert.

The purpose of the script is to validate user credentials that may have been exposed externally by querying LDAP, and to reflect the severity of the incident to the analyst based on the validation results.

Currently, our analysts manually run an on-premises PowerShell LDAP script to perform this validation. Since a SOAR remote agent is already deployed in the on-prem environment, I’m considering leveraging it to trigger the existing script automatically—passing relevant variables from the SecOps alert directly into the script.

This would allow me to build a playbook that fully automates the validation process end-to-end.

I’d appreciate any ideas or recommendations regarding built-in integrations that could support this use case, or alternative approaches that might help streamline and automate the workflow.

Thanks in advance!

[ErikaB]

Hi @elirazo 

I saw your question and wanted to help out. While I don't have the exact answer for you, I found another post in the community that might have the solution you're looking for: https://www.googlecloudcommunity.com/gc/SecOps-SOAR/SOAR-Playbook-Customization/m-p/811617

If it doesn't, please feel free to reply back to your post, and we'll do our best to find another resource to assist you.

[TDRez · Accepted solution]

Hello @elirazo,

Check out the SSH integration, you may be able to trigger the existing functionality that way.