Configure response integrations

Supported in:

Google secops SOAR

Response integrations are installable packages available from the Content Hub. When you install an integration, it adds connectors, playbook actions, and scheduled jobs. This integration lets Google SecOps interact with third-party products to perform security operations tasks.

• Connectors: ingest alerts and events from external sources into Google SecOps.
• Actions: enrich data and perform tasks like blocking IP addresses or sending emails.
• Jobs scheduler: performs scheduled tasks on third-party products directly from Google SecOps.

Install an integration

To install an integration, follow these steps:

1. Go to Content Hub and click the Integrations tab.
2. Search for the integration package you want to install.
3. Click Install.

Note: After you install the integration, you must separately configure the connectors, playbook actions, and scheduled tasks.

Configuration

For detailed setup instructions of how to configure each component, refer to the following guides:

• Ingest data using SOAR Connectors
• Use Actions in Playbooks
• Write Jobs
• Configure an Instance

After configuring the integration, test it to make sure that all components work as expected. Refer to the linked guides for any troubleshooting tips or additional configuration details.

Need more help? Get answers from Community members and Google SecOps professionals.