How to create an alert from a SOAR workflow

Hi ​@scuba-steve,.

The following PRE-GA offering may be something of interest:

Threat Hunt agent overview  |  Google Security Operations  |  Google Cloud Documentation

Otherwise, ‘User Requests’ is something quite nifty which may be something that is useful for you, an out of the box functionality to create a case, based on a pre-defined request. Once this request is raised, you can create a playbook to alert on that Request’s trigger value, so it automatically attaches a playbook to the case.

Create user requests  |  Google Security Operations  |  Google Cloud Documentation

Kind Regards,

Ayman

I’d lean toward the UDM → detection route if the desired output is genuinely a SecOps alert/detection rather than simply another SOAR work item.

The current Chronicle API exposes operations for existing CaseAlerts (get/list/move/update, etc.), but I don’t see a supported general-purpose create operation for CaseAlerts. That fits the normal SecOps model where alerts enter through ingestion/detection and are then grouped into cases.

In that design the playbook could emit a purpose-built UDM event containing the investigation result, environment, correlation identifiers, and relevant entities. A narrowly scoped YARA-L rule can then create the detection/alert. That also preserves the SIEM-side event → detection → alert trail you mentioned.

I’d avoid using User Requests for this particular workflow. Those are designed to create Request Cases from user-submitted request templates, rather than to generate an alert as the result of an investigation.

If you only need to surface the investigation outcome to analysts and don’t specifically require an alert/detection object, then updating the existing case, adding an insight, or creating another workflow artifact would be lighter than generating synthetic telemetry.