Use case
We want to implement a mechanism in Google SecOps (Chronicle SOAR) where, if the same entity (user, IP, or host) accumulates 3 or more alerts within a given time window (e.g. last 24h), the severity is automatically escalated to High — regardless of whether the individual alerts came from Chronicle SIEM, Cortex XDR, Microsoft Defender, or Entra ID.
The individual alerts may be Low or Medium on their own, but the accumulation pattern signals a higher risk that warrants immediate attention.
Question
What is the recommended approach to achieve this in Google SecOps?
We are evaluating:
- A SOAR Playbook that counts open alerts per entity and escalates if threshold is met
- Risk Score Analytics — does this support alerts from third-party connectors (Cortex, Defender) or only Chronicle detections?
- Any native alert grouping or correlation feature in the SOAR that already handles this out of the box
What has worked for others in production? Any pitfalls to be aware of?
Thanks!
