How to quickly detect bugs that don't create cases

Question

Previously, we experienced an issue where cases were not created due to a bug in Google secops.
This was resolved by updating the connector to the latest version.

We are currently considering preventative measures and solutions for this issue.

For example, is it technically possible to use a playbook or something to issue an alert when an issue occurs where a case is not created?

If the above is not possible, we would appreciate it if you could share any ideas you have for checking the latest update announcements as a preventative measure, or for quickly noticing bugs like this one.

cmorris · Answer

You could set up SOAR logging to your BYOP project -https://cloud.google.com/chronicle/docs/soar/investigate/collecting-soar-logs. From there, you could build out monitors in Cloud Monitoring, similar to how you may already do for SIEM ingestion -https://cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metrics.

Reply

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded