SOAR table of contents
Click
at the top of each SOAR document to return to this table of contents.
Get started
Get started with Google SecOps SOAR
Navigate the Google SecOps SOAR platform
Gemini in Google SecOps overview
Release plan for Google SecOps
Administer
Set up an instance
Provide access to Google Support
Configure SOAR access
Authenticate to legacy SOAR API
Manage permission groups
Work with Managed and Managed-Plus user groups
Work with collaborator user groups
Manage environments
Configure custom environment groups
Manage user accounts and access
Apply multiple control access parameters
Configure instance settings
Manage operational settings
Manage administrative assets
Add variables to email templates
Manage case settings
Configure case naming conventions
Create custom fields for cases
Manage custom case closure fields
Configure the close case dialog
Configure the default case view
Manage alert settings
Configure the default alert view
Configure networks and multi-tenancy
Manage environment load balancing
Migrate SOAR to Google Cloud
Pre-migration validation guide
Migrate SOAR permissions to IAM
Work with Chronicle API list operations
Migrate remote agent authentication infrastructure
Authenticate remote agents with Workload Identity Federation
Build and integrate
Deploy centralized content
Run use cases from the Content Hub
Power ups and utilities
Develop custom capabilities
Get started
Develop your first custom integration
Develop your first custom action
Develop your first email connector
Build and design custom components
Build and configure connectors
Advanced data modeling
Configure calculated fields for cases
Manage response integrations
Configure response integrations
Roll back response integrations
Manage integration dependencies
Manage secrets with secret managers
Contribute community response integrations
Manage remote agents
Get started
Review deployment requirements
Review data flow and protocols
Deploy remote agents
Configure Workload Identity Federation
Configure and validate connectivity
Configure the installer and Docker
Manage and upgrade remote agents
Monitor and manage remote agents
Ingest
Collect data
Ingest data using SOAR connectors
Define environments in SOAR connectors
Map custom date and time in Elasticsearch
Manage alert and event ontology
Configure mapping and assign visual families
Analyze and respond
Create and triage cases
Manage cases from the case queue
Relocate cases between environments
Investigate cases and alerts
Review alert highlights and context
Investigate entities and alerts
Navigate the Entity Explorer page
Respond and resolve
Submit requests from your workdesk
Respond to pending actions from your workdesk
Monitor cases from your workdesk
Monitor case response and closure metrics
Validate case workflows with test cases
Automate
Automation foundations
Build and design playbooks
Use reaction triggers in playbooks
Trigger playbooks by alert type
Automate tasks with playbook loops
Attach playbooks to alerts and cases
Configure predefined widgets in playbook views
Configure playbook logic and behavior
Build logic with the Expression Builder
Specify an instance in dynamic mode
Configure timeouts for async actions
Assign actions and playbook blocks
Assign approval links in actions
Manage and monitor playbooks
Review and manage alert playbook execution
Manage bulk actions and filters in playbooks
Test playbooks with the simulator
Use cases and examples
Create an enrichment playbook block
Monitor and troubleshoot
Troubleshoot system issues
Troubleshoot SOAR functionality
Manage dashboards and reporting
Curated dashboard queries by data source
SOAR data foundations for dashboards
Legacy SOAR dashboards and reports
Legacy SOAR dashboards overview
Explore the SOAR dashboards page
SOAR BigQuery schema reference
Administer SOAR standalone instances
Configure authentication
Configure Google Workspace for SAML
Configure Microsoft Azure for SAML
Configure multiple SAML providers
Manage users and access
Configure just-in-time user provisioning
Map IdP groups for SOAR standalone access
Administration and content tasks
Configure case federation for SOAR standalone
Use the Content Hub for SOAR standalone
Deprovision a SOAR standalone instance