Error "SOAR data source not supported" when querying Cases and Alerts in Native Dashboard

Question

Hi everyone,I'm trying to run queries in the Google SecOps (Chronicle) Native Dashboard using SOAR-related data sources such as Cases, Alerts, Playbooks, and Case History, following the official documentation:Sample YARA-L queries – Cases and AlertsSOAR data in the Native DashboardHowever, when running queries like the one below, I get the following error:Querymatch:
   case.status
outcome:
   $count=count(case.name) Error{
  "error": {
    "code": 400,
    "message": "generic::invalid_argument: SOAR data source not supported: invalid argument",
    "status": "INVALID_ARGUMENT",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "domain": "chronicle.googleapis.com"
      }
    ]
  }
}I've verified that I'm using the documented data sources and fields correctly. Is there any prerequisite to enable SOAR data sources in the Native Dashboard? Or is this feature not yet generally available?Any insights would be appreciated.Thanks in advance!

_K_O · Accepted Answer

SOAR data sources aren't available yet - I had the exact same issue a few weeks ago and was asked to speak to our TAM to get access to it once it hits private preview.

Reach out to your account manager and ask to be added once it becomes available.

SoarAndy · Answer

​@babu_k​@phlucasThis should be out now (for customers on SecOps, for older standalone deployments check your support team)https://cloud.google.com/chronicle/docs/reports/native-dashboardsSOAR data referencehttps://cloud.google.com/chronicle/docs/reference/soar-data-dashboard#playbook-run-status-enumYou should also have access to the Content Hub that has at some prebuilt content inhttps://cloud.google.com/chronicle/docs/secops/content_hubTwo quick examples:$playbookDisplayName = playbook.display_name$playbookStartTime = timestamp.get_date(playbook.start_time.seconds)playbook.metadata.type="REGULAR" // NESTED = Blocksmatch:    $playbookDisplayName, $playbookStartTimeoutcome:    $total = count($playbookDisplayName)case.response_platform_info.response_platform_id = $idcase.display_name = $namecase.tags.name = $tags$tags = /^APT[0-9]/timestamp.get_date(case.create_time.seconds) = $createdmatch:    $name, $created, $id, $tagsorder:  $created desc

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded