Chronicle SecOps SIEM and SOAR

Question

We’ve recently purchased SecOps SOAR capabilities while the SecOps SIEM is in place for more than 2 years.

We have custom rules and also the alerting is available. But no cases are being created in SOAR.

I could see the Google Chronicle is configured. Would lile to know if I’m missing something here, since I’m new to SOAR and SecOps SOAR as well.

_K_O · Answer

Hi ​@Dharma289, this should be automatically set upbut if it’s not, I highly recommend reaching out to your CSE as this is something that they should have helped you set up initially.If you want to confirm that the connector is running, head over to the ingestion settings within the SOARsettings page:https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#chronicle-alerts-connector

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded