[Quick Tip] How to share information between playbooks
Sometimes, you might be in a situation, where you want to share information between multiple playbooks, even a...
SecOps SOAR
This is the place to discuss all things related to SOAR, including best practices, tools, and use cases. We encourage you to ask questions, share your knowledge and experience with the community.
Forum Posts
[Important] New Platform Feature - Custom Fields
This week we released Custom Fields - a new Case Management feature that allows you to extend the cases and al...
Leverage GenAI in automation with Vertex AI integration
We just released a new integration - Vertex AI! It's in public preview. If you are not familiar with Vertex AI...
Upgrade to Python 3.11 for the latest security and functionality updates
Hello Google SecOps Users, On July 14, 2024, Python 3.11 with migration best practices was made available in G...
On-Prem Active Directory Integration using API connectivity
Is it possible to integrate Active Directory on-prem with SOAR using API connectivity. If yes, please guide us...
Case Comment preservation when Merging Cases
Hello everyone,When merging two cases in SecOps SOAR, the comments should stay on the Case Wall, however, I've...
Tanium Integration with Service User account
Hi Team,Wanted to understand if we can use service username and password to integrate Tanium integration with ...
Is it possible to create an exception via an action in SOAR?
I'm working with SOAR and I would like to know if it's possible to create an exception through a custom action...
HTML Widgets and Placeholder Values from Playbook Actions
Are you able to use the placeholder fields from playbook action jsonresults in the html widgets? Some examples...
Remote agent High availability
I'd like to know what people are using as far as High availability solution for the remote agents for SOAR?Hav...
Access returned values from String Function
Hi All, Does anyone know how I access the returned values from a string function. My current use case: I am us...
Create case api how to get the caseid back
Hi,We have a use case where we need to create cases via the following endpoint:/api/external/v1/cases/CreateCa...
Rerun block swagger API issue
https://unilever.siemplify-soar.com/api/external/v1/playbooks/RerunBlockHi Team i want to execute this api end...
Track Mean time to Respond
Hi,I'm looking to track Mean Time to Respond (MTTR) for our SecOps team. Specifically, I want to measure the d...
Jira on prem - integration issue - API keys vs Personal access token
Hello, I'm unsuccessful in configuring the Jira integration ( On-prem instance ) in SecOps SOAR, receiving Jir...
Issue with create_exception in FortiEDR
I'm trying to create an exception in FortiEDR using the create_exception method from the Exceptions class in t...
How to remove
Hi everyone, how are you doing?I've been struggling with a small issue and can't seem to find the solution.I w...
Integration of MS Defender for Identity and other defender solutions
Hi Team,I have a few questions:Does the current 'Microsoft 365 Defender' integration package include the Defen...
Mapping alerts correctly
Hi, How are you doing?I've been having problems with the mapping for this It is supposed to come from AzureAD ...
Link Click Tracker Automation
Hello all,I have received a request to automate some way to track who "actions" an email - where by actioning ...
Custom Action - Get package SAS URI API
HI All,I'm building this custom action - https://learn.microsoft.com/en-us/defender-endpoint/api/get-package-s...
'Script did not return expected data" error in actions
When building our integration, we're seeing the error"Script did not return expected data. Did you call build_...
Microsoft Defender ATP Integration permissions
Hey Team,I am looking for giving least privileges to SOAR on defender ATP to only do enrichments and some data...
Playbook prioritization
Hi everyone,I've created an SLA playbook that alerts analysts when a critical SLA threshold is reached, along ...
SecOps SOAR Integration Health Monitoring
Hi Everyone!TL;DR Is there a preferred / Google supported manner which the health of configured integrations c...
Creating Metrics Dashboards based on Tags
Hi all!Has anyone created dashboards based on SecOps tags? I have to create some reports every quarter based o...
How to replace a comma using the Expression Builder for Google SOAR Webhooks integration
while working on receiving alerts from Cloudlfare via webhook, I need to replace the only text field that is s...
Remote Agent Certificate Validation Errors
We are trying to have a remote agent communicate with a firewall management console on prem but we're getting ...
Adding Entities from Source Case to Current Case in Action
I am currently working on a custom action to copy entities from a source case to the current case. Despite the...
How to force blocks to only send one output to a parent playbook
Say I have a block with 4 possible paths, but only 1 path will ever run. The way secops blocks are set up I ha...
Quick Actions & Playbook Blocks
Hello,I have a question about the "Quick Action" Feature. I understand that you can use quick action buttons l...
Default Alert View
Hello, I am creating a custom alert view for a playbook - which should be available to view for all roles I ha...
Create Alert in a Playbook
In a playbook that was activated by an alert from a specific Product, I am trying to create an alert in a diff...
JSON FIlter Documentation
I think I have a syntax issue. Or I am doing this wrong?I want to filter out all message ID's that are rejecte...
