Google Cloud
Documentation Technology areas
  • AI and ML
  • Application development
  • Application hosting
  • Compute
  • Data analytics and pipelines
  • Databases
  • Distributed, hybrid, and multicloud
  • Generative AI
  • Industry solutions
  • Networking
  • Observability and monitoring
  • Security
  • Storage
Cross-product tools
  • Access and resources management
  • Costs and usage management
  • Google Cloud SDK, languages, frameworks, and tools
  • Infrastructure as code
  • Migration
Related sites
  • Google Cloud Home
  • Free Trial and Free Tier
  • Architecture Center
  • Blog
  • Contact Sales
  • Google Cloud Developer Center
  • Google Developer Center
  • Google Cloud Marketplace
  • Google Cloud Marketplace Documentation
  • Google Cloud Skills Boost
  • Google Cloud Solution Center
  • Google Cloud Support
  • Google Cloud Tech Youtube Channel
/
  • English
  • Deutsch
  • Español – América Latina
  • Français
  • Português – Brasil
  • 中文 – 简体
  • 日本語
  • 한국어
Sign in
  • Google Security Operations
Guides Reference Resources
Contact Us Start free
Google Cloud
  • Documentation
    • Guides
    • Reference
    • Resources
  • Technology areas
    • More
  • Cross-product tools
    • More
  • Related sites
    • More
  • Console
  • Contact Us
  • Start free
  • Overview
  • All Security Operations Topics
  • Google SecOps overview
  • What's new in Google SecOps?
  • Login to Google Security Operations
  • Navigate the Google SecOps platform
  • Understand the Google SecOps platform
  • Gemini in Security Operations
  • Onboarding
  • Onboarding of Google SecOps instance
  • Configure a Google Cloud project for Google SecOps
  • Configure a Google Cloud identity provider
  • Configure a third-party identity provider
  • Link Google SecOps to Google Cloud services
  • Configure feature access control using IAM
  • Configure data RBAC using IAM
  • RBAC user guide for applications not using IAM
  • Map users in the Google SecOps platform
  • User management
  • Quickstart: Conduct a search
  • Quickstart: Investigate an alert
  • Data Collection
  • Ingestion
    • Google SecOps data ingestion
    • Overview of data ingestion
    • Supported data sets and default parsers
    • Ingest data to Google SecOps
      • Install and configure forwarders
        • Install and configure the forwarder
        • Manage forwarder configurations through the UI
        • Manage forwarder configurations manually
        • Google SecOps forwarder executable for Windows
        • Troubleshoot common Linux forwarder issues
    • Use the BindPlane agent
    • Set up data feeds
      • Feed management overview
      • Use the feed management application
      • Use the feed management API
    • Use ingestion scripts deployed as Cloud Functions
    • Use the Ingestion API
    • Configure burst limits
  • Ingest logs from specific sources
    • Ingest from Google Cloud
      • Configure Google Cloud ingestion
      • Collect Cloud Audit logs
      • Collect Cloud NAT logs
      • Collect Fluentd logs
      • Collect Google Cloud Firewall logs
      • Collect Google Cloud Load Balancing logs
      • Collect Google Kubernetes Engine logs
      • Send Google Workspace data to Google SecOps
      • Collect Google Workspace logs
      • Collect Chrome management logs
      • Collect reCAPTCHA Enterprise logs
      • Collect Security Command Center findings
      • Collect Nix System logs
    • Ingest from AWS
      • Collect AWS GuardDuty logs
      • Collect AWS VPC Flow logs
      • Collect Amazon CloudFront logs
      • Collect AWS RDS logs
    • Ingest from Azure
      • Collect Azure Activity logs
      • Collect Azure AD logs
    • Install Carbon Black Event Forwarder
    • Ingest from Cisco
      • Collect Cisco ASA firewall logs
      • Collect Cisco ISE logs
      • Collect Cisco Meraki logs
      • Collect Cisco Secure Email Gateway logs
      • Collect Cisco Secure ACS logs
    • Collect Cloudflare WAF logs
    • Collect Corelight Sensor logs
    • Collect Crowdstrike EDR logs
    • Collect CyberX logs
    • Collect Fidelis Network logs
    • Collect Forcepoint DLP logs
    • Collect FortiWeb WAF logs
    • Collect F5 BIG-IP APM logs
    • Collect F5 BIG-IP LTM logs
    • Collect Imperva Incapsula Web Application Firewall logs
    • Collect Infoblox logs
    • Collect Juniper Junos logs
    • Ingest from Jamf
      • Collect Jamf Protect logs
      • Collect Jamf Telemetry logs
    • Collect Linux auditd and Unix system logs
    • Collect Okta logs
    • Ingest from Microsoft
      • Collect Microsoft 365 logs
      • Collect Microsoft Graph security API alert logs
      • Collect Microsoft Intune logs
      • Collect Microsoft Windows AD data
      • Collect Microsoft Windows DHCP data
      • Collect Microsoft Windows DNS data
      • Collect Microsoft Windows Event data
      • Collect Microsoft Windows Sysmon data
    • Collect OneLogin Single Sign-On (SSO) logs
    • Collect osquery logs
    • Collect OSSEC logs
    • Ingest from Palo Alto Networks
      • Collect Palo Alto Cortex XDR alerts logs
      • Collect Palo Alto Networks firewall logs
      • Collect Palo Alto Prisma Cloud logs
    • Collect SentinelOne Cloud Funnel logs
    • Collect Splunk CIM logs
    • Collect Suricata Eve logs
    • Collect Zeek (Bro) logs
  • Ingest entity data
  • Parsing
    • Overview of log parsing
    • Overview of the Unified Data Model
    • Manage prebuilt and custom parsers
    • Use parser extensions
    • Important UDM fields for parser data mapping
    • Tips and troubleshooting when writing parsers
    • Format log data as UDM
  • Data enrichment
  • Monitoring and troubleshooting
    • Use Data ingestion and Health dashboard
    • Using Cloud Monitoring for ingestion notifications
  • Using connectors
    • Ingest data using SOAR connectors
    • View connector logs
    • ElasticSearch connector: Map a custom date and time
    • Define environments in SOAR connectors
  • Using webhooks
    • Set up a webhook
  • Ontology
    • Ontology overview
    • Create entities (mapping and modeling)
    • View model family and field mapping
    • Visual families
    • Decide what events to configure
    • Configure mapping and assign visual families
    • Work with entity delimiters
  • Threat detection
  • Introduction to threat detection rules
    • View alerts and IOCs
    • Review potential security issues
    • Single event rules
    • Multiple event rules
  • Monitor events using rules
    • View rules in the Rules Dashboard
    • Manage rules using the Rules Editor
    • View previous versions of a rule
    • Archive rules
    • Download events
    • Run a rule against live data
    • Run a rule against historical data
    • Set the run frequency
    • Detection limits
    • Rule errors
  • Create context-aware analytics
    • Overview
      • Overview
      • Rule errors
    • Use Sensitive Data Protection data in context-aware analytics
  • Use context-enriched data in rules
  • Use default detection rules
  • Use Risk Analytics
    • Overview of Risk Analytics
    • Use the Risk Analytics dashboard
    • Create rules for Risk Analytics
    • Specify entity risk score in rules
  • Work with Google SecOps curated detections
    • Use curated detections
    • Use curated detections to identify threats
    • Overview of Cloud Threats category
    • Overview of Linux Threats category
    • Overview of Risk Analytics for UEBA category
    • Overview of Windows Threats category
    • Overview of Applied Threat Intelligence curated detections
    • Verify data ingestion using test rules
    • Configure rule exclusions
  • Threat Investigation
  • Investigate an alert
  • Investigate a GCTI alert
  • Searching for data
    • Search for a UDM event
    • Use context-enriched fields in UDM search
    • Use UDM Search to investigate an entity
    • Generate UDM search queries with Gemini
    • UDM search best practices
    • Search raw logs
    • Filter data in raw log search
    • Create a reference list
  • Using investigative views
    • Use investigative views
    • Investigate an asset
    • Work with asset namespaces
    • Investigate a domain
    • Investigate an IP address
    • Investigate a user
    • Investigate a file
    • View information from VirusTotal
  • Filtering data in investigative views
    • Overview of Procedural Filtering
    • Filter data in User view
    • Filter data in Asset view
    • Filter data in Domain view
    • Filter data in IP Address view
    • Filter data in Hash view
  • Threat intelligence
  • Applied Threat Intelligence
    • Introduction to Applied Threat Intelligence
    • Applied Threat Intelligence prioritization
    • View IOCs using Applied Threat Intelligence
    • IC score overview
    • Applied Threat Intelligence fusion feed overview
  • About the YARA-L language
    • YARA-L 2.0 language overview
    • YARA-L 2.0 language syntax
    • YARA-L best practices
    • Generate a YARA-L rule using Gemini
  • Answer Threat Intelligence questions with Gemini
  • Timestamp definitions
  • Cases and alert management
  • Alerts
    • Alert Overview tab
    • Alert Playbooks tab
    • Change alert priority instead of case priority
    • Use the Alert Events tab
    • About the alert grouping mechanism (Admin)
    • Rerun playbooks
    • How to configure the alert overflow mechanism (Admin)
    • Define the Default Alert view (Admin)
    • Handle large alerts
  • Cases
    • Cases overview
    • Cases page
    • Case Queue header
    • Case Overview tab
    • Case Wall tab
    • Instant messages in a case
    • Manage tasks from the Cases page
    • Perform a manual action
    • Manage tags from the Cases page
    • Actions you can take on a case
    • Mark a case as an incident
    • Simulate cases
    • Create a test case
    • How to close cases
    • View the contents of closed cases
    • Using the Gemini Case summary widget
    • Define tags in cases (Admin)
    • Define a default view for cases (Admin)
    • Use the Gemini Summary
    • Add or delete case stages (Admin)
    • Use the Alert Options menu in the Cases page
    • View the original SIEM data in a case
    • Explore SOAR entities and alerts (Investigation)
    • Entity types that SOAR supports
    • Navigating the Entity Explorer page
    • Perform a batch action on several cases at once
    • Measure how long security analysts take to close or raise a case
    • Add a new case close root cause (Admin)
    • Define a case name (Admin)
    • Create a manual case
    • Move a case to a new environment
    • Add or edit entity properties
    • Apply and save filters
    • Entity selection
  • Workdesk
    • Workdesk overview
    • Fill out a request from the workdesk
    • Respond to pending actions from the workdesk
    • Views cases from the workdesk
  • Search and investigation
  • Search for a normalized event
    • Search for a UDM event
    • Use context-enriched fields in UDM search
    • Use UDM search to investigate an entity
    • UDM search best practices
  • Search for raw events
    • Search raw logs
    • Filter data in raw log search
    • Create a reference list
  • Investigate an alert
  • Using investigative views
    • Use investigative views
    • Investigate an asset
    • Work with asset namespaces
    • Investigate a domain
    • Investigate an IP address
    • Investigate a user
    • Investigate a file
    • View information from VirusTotal
  • Filtering data in investigative views
    • Overview of Procedural Filtering
    • Filter data in User view
    • Filter data in Asset view
    • Filter data in Domain view
    • Filter data in IP Address view
    • Filter data in Hash view
  • Search
    • Work with the SOAR Search page
  • About the YARA-L language
    • YARA-L 2.0 language overview
    • YARA-L 2.0 language syntax
    • YARA-L best practices
  • Respond
  • Playbooks
    • Playbooks page
    • Use triggers in playbooks
    • Use actions in playbooks
    • Use flows in playbooks
    • Create and edit a playbook with Gemini
    • Use the Expression Builder
    • Work with the Playbook Simulator
    • Use the Playbook Navigator
    • Work with playbook blocks
    • About playbook monitoring
    • Define customized alert views from playbook designer
    • Use an alert type trigger in a playbook
    • Bulk actions and filters in playbooks
    • Use the HTML widget
    • Scan multiple URLs in VirusTotal
    • Put elements of the case data into an email message
    • Scan URLs received by email
    • Send messages to a phone number
    • Attach playbooks to an alert
    • Use cases for Expression Builder
    • Assign actions and playbook blocks
    • Playbook icons legend
    • Configure timeouts for playbook async actions
    • Playbook permissions
    • Assign approval links in actions
    • Use parallel actions
    • Use predefined widgets in playbook views
    • Prevent users from changing playbooks
    • Send an email from Google SecOps
  • IDE
    • Use the IDE
  • Custom code and integrations
    • Create a custom action
    • Build a custom integration
    • IDE custom code validation
    • Write jobs
    • Test integrations in staging mode
    • Set up integrations
      • Upgrade the Python version to 3.11
      • Support multiple instances
      • Work with an external vault system
    • My first custom integration
    • My first action
    • My first automation (playbook)
    • My first connector
    • Develop the connector
    • Configure the connector
    • Test the connector
    • Map and model alerts
    • My first use case
    • Requirements for publishing your first use case
  • Remote agents
    • What is a remote agent?
    • Requirements and prerequisites
    • Remote agent architecture
    • Remote agent scaling strategy
    • Manage remote agents
    • Create an agent with Docker
    • Create an agent with the installer on RHEL
    • Create an agent with the installer on CentOS
    • Upgrade agent Docker image
    • Upgrade an agent with the installer for RHEL
    • Upgrade an agent with the installer for CentOS
    • Edit a remote agent
    • Redeploy remote agent
    • Installer and Docker agent configuration
    • Data flows and protocols
    • Set up integrations and connectors
    • Test agents
    • Upgrade remote agents
    • Deploy high availability for remote agents
    • Troubleshooting
  • Incident Manager
    • Incident Manager overview
    • Open an incident from Incident Manager
    • Open Incident Manager from the Cases page
    • Define departments for Incident Manager
    • Define auditors in the Incident Manager
    • Define authorized environments
    • Invite collaborators to Incident Manager
    • Work with the Incident Manager dashboard
    • Use the workstation
    • Create an incident report
  • Dashboard and Reports
  • SOAR dashboards
    • SOAR Dashboards overview
    • Add new SOAR Dashboards
    • Add SOAR Dashboard widgets
    • Example: Add a new widget to a SOAR Dashboard
    • SOAR Dashboards page
  • SOAR Reports
    • Understand SOAR Reports
    • Use advanced SOAR Reports - Looker
    • Default Advanced SOAR Reports in depth
    • Generate ROI reports in SOAR (SOC Managers)
    • Deep dive into four advanced reports in SOAR
  • SIEM reports and dashboards
    • Overview of Google SecOps data in BigQuery
    • Work with dashboards
    • Create a custom dashboard
    • Add a chart visualization to a dashboard
    • Share a personal dashboard
    • Schedule dashboard reports
    • Use context-enriched data in reports
    • Import and export Google SecOps dashboards
  • User management
  • Control access to SecOps platform
  • Permissions, SOC roles and environments
    • Work with permission groups
    • Work with roles
    • Add a new environment
    • Use dynamic parameters in environments
    • Delete an environment
    • Allow access to other environments
    • Case Federation for Google SecOps
    • View users in Google SecOps
    • Types of user groups in Google SecOps
    • Set your time zone
  • Data RBAC
    • Overview of data RBAC
    • Data RBAC impact on features
    • Configure data RBAC for users
    • Configure data RBAC for reference lists
  • Administration
  • Tasks
    • View my SOAR customer ID
    • Work with API Keys in SOAR
    • Allow Google Support to access your platform
    • Define the landing page on login
    • Create a block list to exclude entities from SOAR alerts
    • Create custom lists
    • Create email HTML templates
    • Create email templates
    • Define domains for MSSPs
    • Define requests for users (Admin)
    • Manage networks
    • Set the SLA
    • Use dynamic variables in email HTML templates
    • Open a ticket for Google Support
    • Define system data retention
    • Monitor user activities
    • Rebrand overview
    • Set time zone for all users (Admin)
    • Set up your email
    • View and change service limits
    • Manage properties metadata
    • Retrieve raw Python logs
    • Google Analytics in Google SecOps
    • Data retention
    • Audit Logs
    • Google SecOps CLI user guide
  • Google SecOps Marketplace
  • Use the Google SecOps Marketplace
  • Run use cases
  • Power Ups overview
    • Connectors
    • Email utilities
    • Enrichment
    • File utilities
    • Functions
    • GitSync
    • TemplateEngine
    • Insights
    • Lists
    • Tools
  • SIEM
  • SIEM standalone Table of Contents
  • SOAR
  • SOAR standalone Table of Contents
  • Work with users (SOAR only)
    • Add a new user to the SOAR platform
    • Benefits of adding a collaborator user
    • Create a collaborator user
    • Create a user with view-only permission
    • Disable or delete a user account in Chronicle SOAR
    • Types of users
    • Create a managed user
    • Email invitation prerequisites
    • Password policy (SOAR only)
    • Case management federation (SOAR only)
    • Create environment groups (SOAR only)
    • Clean up after removing SOAR
    • Control access to SecOps platform
  • SAML overview (SOAR only)
    • Configure a SAML provider
    • SAML configuration for Google Workspace
    • SAML configuration for Microsoft Azure
    • SAML configuration for Okta
    • Just-in-time user provisioning
    • Configure multiple SAML providers
  • AI and ML
  • Application development
  • Application hosting
  • Compute
  • Data analytics and pipelines
  • Databases
  • Distributed, hybrid, and multicloud
  • Generative AI
  • Industry solutions
  • Networking
  • Observability and monitoring
  • Security
  • Storage
  • Access and resources management
  • Costs and usage management
  • Google Cloud SDK, languages, frameworks, and tools
  • Infrastructure as code
  • Migration
  • Google Cloud Home
  • Free Trial and Free Tier
  • Architecture Center
  • Blog
  • Contact Sales
  • Google Cloud Developer Center
  • Google Developer Center
  • Google Cloud Marketplace
  • Google Cloud Marketplace Documentation
  • Google Cloud Skills Boost
  • Google Cloud Solution Center
  • Google Cloud Support
  • Google Cloud Tech Youtube Channel
  • Home
  • Google Security Operations
  • Documentation
  • Guides
Stay organized with collections Save and categorize content based on your preferences.

Playbook icons legend

Supported in:
Google SecOps SOAR

The following icons appear in the Playbooks tab in the Cases page when a playbook is attached.

customized alert view.
customized alert view.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2024-10-30 UTC.

  • Why Google

    • Choosing Google Cloud
    • Trust and security
    • Modern Infrastructure Cloud
    • Multicloud
    • Global infrastructure
    • Customers and case studies
    • Analyst reports
    • Whitepapers
    • Blog

  • Products and pricing

    • Google Cloud pricing
    • Google Workspace pricing
    • See all products

  • Solutions

    • Infrastructure modernization
    • Databases
    • Application modernization
    • Smart analytics
    • Artificial Intelligence
    • Security
    • Productivity & work transformation
    • Industry solutions
    • DevOps solutions
    • Small business solutions
    • See all solutions

  • Resources

    • Google Cloud Affiliate Program
    • Google Cloud documentation
    • Google Cloud quickstarts
    • Google Cloud Marketplace
    • Learn about cloud computing
    • Support
    • Code samples
    • Cloud Architecture Center
    • Training
    • Certifications
    • Google for Developers
    • Google Cloud for Startups
    • System status
    • Release Notes

  • Engage

    • Contact sales
    • Find a Partner
    • Become a Partner
    • Events
    • Podcasts
    • Developer Center
    • Press Corner
    • Google Cloud on YouTube
    • Google Cloud Tech on YouTube
    • Follow on X
    • Join User Research
    • We're hiring. Join Google Cloud!
    • Google Cloud Community
  • About Google
  • Privacy
  • Site terms
  • Google Cloud terms
  • Manage cookies
  • Our third decade of climate action: join us
  • Sign up for the Google Cloud newsletter Subscribe
  • English
  • Deutsch
  • Español – América Latina
  • Français
  • Português – Brasil
  • 中文 – 简体
  • 日本語
  • 한국어