How to create an alert from a SOAR workflow

Hi ​@scuba-steve,.

The following PRE-GA offering may be something of interest:

Threat Hunt agent overview  |  Google Security Operations  |  Google Cloud Documentation

Otherwise, ‘User Requests’ is something quite nifty which may be something that is useful for you, an out of the box functionality to create a case, based on a pre-defined request. Once this request is raised, you can create a playbook to alert on that Request’s trigger value, so it automatically attaches a playbook to the case.

Create user requests  |  Google Security Operations  |  Google Cloud Documentation

Kind Regards,

Ayman

HI ​@scuba-steve ,

Great question — you’re right that there are two main paths to generate an alert programmatically after playbook investigation:

• Create UDM event → Feed a synthetic UDM event back into SecOps, then let a detection rule trigger on it.

• SOAR API alert creation → Call the SOAR API directly to raise an alert object.

🔑 Trade‑offs

• UDM event route

  • ✅ Preserves full lineage: event → detection → alert.

  • ✅ Easier to audit and correlate in investigations.

  • ❌ Requires building a custom integration to emit UDM JSON in the correct schema.

• SOAR API route

  • ✅ Faster and simpler to implement.

  • ✅ No need to model UDM schema.

  • ❌ Bypasses detection pipeline, so the trail is less complete.

🛠 Practical guidance

1

Decide alert lineage

Choose whether you want alerts tied to detections or created directly.

• If audit trail is critical → use UDM event

• If speed is priority → use SOAR API

2

Build UDM event emitter

Construct JSON in Chronicle UDM schema and POST via ingestion API.

• Map playbook output to UDM fields

• Send to ingestion endpoint

• Detection rules trigger on synthetic event

3

Use SOAR API for direct alert

Call the SOAR API endpoint to create an alert object.

• Provide case ID, severity, description

• Alert appears immediately in SecOps

• No detection trail

4

Validate permissions

Ensure your integration account has rights to ingest UDM or call SOAR API.

• Check RBAC roles

• Test with Admin vs Analyst accounts

• Log API responses for troubleshooting

Sources:

👉 In short: if you want proper lineage and auditability, go via UDM event → detection → alert. If you need speed and simplicity, use the SOAR API. Both require custom integration, but the UDM path aligns better with SecOps design philosophy.