Manage statistics

Supported in:

This document explains how to configure statistics tracking in Google SecOps. You can define which case and event properties (each identified by a System Name) are tracked for statistical analysis. By configuring these properties, you control what metadata is processed to generate case statistics, helping analysts understand trends and distributions of specific properties (such as DeviceProduct or DestinationPort) involved in security alerts.

Add statistics

To add a new property to statistics tracking, follow these steps:

  1. Go to SOAR Settings > Data Configuration > Statistics.
  2. Click Add.
  3. In the Add Statistics dialog, select a property from the System Name drop-down menu.
  4. Click Save.

Practical application

Configuring statistics lets you optimize operations and identify trends:

  • SOC Optimization: Tracking common properties like DeviceProduct helps the SOC understand which security tools are generating the most alerts.
  • Troubleshooting: Tracking properties like CategoryOutcome can help identify if certain connectors are constantly failing or returning specific statuses.

Need more help? Get answers from Community members and Google SecOps professionals.