Skip to main content
Question

Google SecOps Scheduled Report via Email

  • September 15, 2026
  • 3 replies
  • 30 views

soaruser
Forum|alt.badge.img+6

Hi everyone,

How to change the "From Email address" in SecOps Scheduled Reports. As I can see it is being sent from Google SMTP server, But I don't want to send data to Google SMTP instead I want to use our internal SOAR Email Integration to send this scheduled report via email.

 

3 replies

cmorris
Staff
Forum|alt.badge.img+17
  • Staff
  • September 15, 2026

You cannot. You could however, put together a custom action to export the dashboard via an instant report and then use your email integration to send that.


soaruser
Forum|alt.badge.img+6
  • Author
  • Bronze 2
  • September 15, 2026

Thanks for quick response ​@cmorris 

But the problem with manual SOAR playbook solution is scheduling this playbook using schedule connector will create new cases on every run. These cases will show up in normal security cases list, then it will be difficult for monitoring team to differentiate normal Security cases with these scheduled playbooks cases. 

 

FYI: In our environment, L1 can see all L2, L3 cases so even if I assign these scheduled playbook related cases to other role, it will still be Visible to L1. 

 

 

 

 


matt-amastra
Forum|alt.badge.img+1
  • Bronze 1
  • September 15, 2026

@soaruser If you don’t want to generate cases for this, you can build a custom job instead of a custom action/playbook. Then you just create a job instance to run on a schedule for each dashboard/audience/cadence combination you want to support, no case necessary.