I'm trying to access detailed audit logs specifically for SOAR Playbooks. Currently, I can view the audit logs for SIEM rules using metadata.product_name = "Google Cloud Platform", but I'm unable to locate similar logs for SOAR Playbooks.
Has anyone managed to find or configure audit logging specifically for SOAR Playbooks?
+16SOAR has the audit logs under SOAR Settings, Advanced, Audit.
You can see from an inspection that it is calling /api/external/v1/settings/ExportAuditLastWeekAsCsvV2
THere's no direct way to do it right now. You could probably piece together a clunky way to do it with a CSV export and then use ingest API to get the data.
I'm questioning the value to do something like this - what would you do with that data if it was in SIEM?
SOAR has the audit logs under SOAR Settings, Advanced, Audit.
You can see from an inspection that it is calling /api/external/v1/settings/ExportAuditLastWeekAsCsvV2
THere's no direct way to do it right now. You could probably piece together a clunky way to do it with a CSV export and then use ingest API to get the data.
I'm questioning the value to do something like this - what would you do with that data if it was in SIEM?
@dnehoda Yes it has under Audit and can be exported as CSV, but if it is searchable like SIEM Audit logs, we can track the playbook run/error efficiently.
Hello,
I believe the ability to search SOAR logs (including playbooks) in Google Cloud logging is coming. Unfortunately we don't have a firm date as of yet.
+16Hello,
I believe the ability to search SOAR logs (including playbooks) in Google Cloud logging is coming. Unfortunately we don't have a firm date as of yet.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
