[Quick Tip] How to share information between playbooks
Sometimes, you might be in a situation, where you want to share information between multiple playbooks, even a...
SecOps SOAR
This is the place to discuss all things related to SOAR, including best practices, tools, and use cases. We encourage you to ask questions, share your knowledge and experience with the community.
Forum Posts
[Important] New Platform Feature - Custom Fields
This week we released Custom Fields - a new Case Management feature that allows you to extend the cases and al...
Leverage GenAI in automation with Vertex AI integration
We just released a new integration - Vertex AI! It's in public preview. If you are not familiar with Vertex AI...
set context value for field for multiple values
i have these values from the events which is MME file typebut some events have 3 values ,4 values ,5 values -w...
activityKind
HiI was wondering if there is an official list of activityKind?I see activitykind in wall data json for a give...
Soar remote agent
Hi, reading the official doc it says that is necessary to install RHEL 8.7 or centos 7.9, but manual installat...
Issue with "Google Chronicle - Run UDM Query" Action
I'm currently trying to run a query with the run UDM query action in the "Google Chronicle" integration. When ...
Issues with the "Blocklist" - Exclusion does not work
Hello team,Some of our alerts are grouped into one case because of a similar IP Address (0.0.0.0).When trying ...
Replace Old Block with New in the playbook
Hi,I have a working playbook with multiple blocks. To make changes in one of the block i made a copy of the bl...
Create entity
I am using the Create Entity action and trying to create entities for internal ips and domains in a playbook. ...
ArcSight Security Events Connector: Error Finding Report
Has anyone here in the Google SecOps Community encountered errors to find reports when setting up a connector ...
Stop duplicate entities from being created on a specific case
Good day all, Is there a way to stop duplicate entities from being created on a specific case? For example, I ...
How to query SIEM Logs via SOAR action
I am trying to create a custom action in google secops SOAR in which I am fetching some data and it needs to b...
Freshworks Freshservice 'Create Ticket' action giving error
Hi Guys,I integrated Freshservice ITSM with SOAR. When I am trying to create ticket getting below error:There ...
Can we update udm outcome fields via playbook?
we have created custom description UDM filed which needs to be updated using playbook with user information.Qu...
curated detections routing
I'm observing that curated detections are being routed to all environment .How can we manage or control this t...
Error executing action CrowdStrike - List Hosts. Reason: Incorrect Customer ID specified.
i have specified right customer ID any idea why it is throwing this error
Chronicle SOAR integration with XSOAR
Hello,I seek to integrate my Chronicle Soar with my XSOAR tool within my on-premises environment. Is there a b...
Is there a way to use \ change the Properties Metadata - System name?
Hey,A quick explanation, we have clients with different SIEMs, and for each client different fields.For exampl...
TrendMicro Vision missing blocking action
The TrendMicro Vision integration from marketplace is missing a key action seen in many other soar environment...
Where can I find the license types for Chronicle?
hi, where can I find the licence types (the best with pricing) for Chronicle? I see only Community plan which ...
Can i Integrate Chronicle SIEM with MISP or a similar platform like OpenCTI?
Hey Folks, Has anybody integrated Chronicle SIEM with MISP or a similar platform like OpenCTI? I'm pretty sure...
Delete unused tags within SOAR search?
Hello,Is there a way to delete unused tags within Google Security Operations?A little explanation: I created a...
Block an admin user using Gsuite integration
Hi team,I'm implementing GSuite integration.During the test, I found out that the "Update User" action allows ...
Delay in ingesting Sentinel incident having no associated event
Hi Guys,I have encountered an issue:A Sentinel Incident was triggered without any associated event. Consequent...
Enable playbook monitoring for failure actions
Team,I need to receive an email notification if any action in a playbook fails more than 3 times within a 3-ho...
How to identify integrations that are running outdated versions of Python
As part of the routine management of your SecOps platform, you should ensure that any configured integrations ...
Spammed by 'Overflow Case'
Hi all,New to SecOps, so forgive me if this is already a known issue.I was fixing up a rule that was bugged, a...
Need some guidance using MS Teams Integration
Hi community,we are a relatively new customer of Google SOAR & SecOps.I am currently trying to set up some pla...
Syncing Entities From SOAR to SIEM
I'm adding new properties to entities via playbooks or manual actions and I am looking for a way to have those...
BMC Helix Business Workflows integration with Google SecOps SOAR
Hello Guys, Is there any integration solution available to integrate BMC Helix Business Workflows with SOAR?. ...
Alerts Grouping settings issues with unique alert name
The Alerts Grouping Settings page lets you create grouping rules controlling the exact type of alerts which ar...
When passing a event variable to a widget - is there any way to prevent it from deduplicating?
When passing a event variable to a widget - is there any way to prevent it from deduplicating. For example, I ...
