+6How do I automate the process to send an email alert to team if log source is not reporting.
1.SOAR Dashboard: I have created a query to fetch last reported time of each log_type, but how do I trigger an email if last reporting time is greater than x hours or something?
Best answer by cmorris
Dashboard reports can be scheduled, but will not act with a trigger. While you could build a job to email a report, you would still need a trigger.
I would recommend using Cloud Monitoring for ingest notifications - https://docs.cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metrics#detect-collect-agents. You will have the option to specify notification channels - ex. Email, Slack, Webhooks. I have seen the webhooks used to then feed the ingest alert from GCP into the SOAR as well.
If you go to Dashboards > Health Hub, you will be able to see your sources and if you choose the alert flags from the screenshot below, you will be brought to a GCP with a template alerting policy for the source that you can then configure.
+14Dashboard reports can be scheduled, but will not act with a trigger. While you could build a job to email a report, you would still need a trigger.
I would recommend using Cloud Monitoring for ingest notifications - https://docs.cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metrics#detect-collect-agents. You will have the option to specify notification channels - ex. Email, Slack, Webhooks. I have seen the webhooks used to then feed the ingest alert from GCP into the SOAR as well.
If you go to Dashboards > Health Hub, you will be able to see your sources and if you choose the alert flags from the screenshot below, you will be brought to a GCP with a template alerting policy for the source that you can then configure.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
