Question

Google SecOps multitenant Chronicel SOAR connector misses original case ID

+1

Hello,

I am working on a parent-child multitenant solution.

Child alerts are pulled by the Parent SOAR and a new case is created, however the original case ID (the one created by the Child) is missing.

Is there any way to find the original case ID (ID created by the Child) in the Parent SOAR?

Thank you!

+11

how was the alerts being pulled from child → parent? or how was the parent-child is being configured?

+1

From the Parent using the Chronicle SOAR Connector.

Federated Cases in in pre-GA and our Google rep. recommended not to use it until GA.

+1

FYI… Connector name: “Google Chronicle - Chronicle Alerts Connector” and running the latest version.

Sign up