⚠️ Part 2: SOAR Data Limitation & Accessing Legacy BigQuery
Important Platform Note:
SOAR data is not currently supported in Advanced BigQuery Export.
(Documentation Reference: "Data from Google Security Operations SOAR (search_everything_db) isn't supported in Advanced BigQuery Export.")
To query case management, playbook runs, and SOC response metrics in BigQuery, you must access the SOAR BigQuery database (siemplify_search_everything_db) via the legacy/BYOBQ pipeline.
Prerequisites for SOAR BigQuery Access
- SOAR Advanced Reporting Enabled: Your Google SecOps tenant must have SOAR Advanced Reporting enabled before the platform can publish data to BigQuery.
- Identity: You need a valid Google Account / Workspace Identity (GAIA) or Service Account.
How to Grant / Request Access to SOAR BigQuery
There are two primary methods to obtain access:
Method 1: Open a Google Cloud Support Case
If you are setting up BYOBQ or need your SOAR tenant's BigQuery dataset linked to your project/analyst accounts, submit a case via the Google Cloud Support Portal with your Customer ID, SecOps instance details, and the analyst/service account email addresses requiring access.
Method 2: Use the BigQuery Access API (Legacy Backstory API)
You can programmatically grant access using the BigQuery Access API with an authorized OAuth2 Service Account token (https://www.googleapis.com/auth/chronicle-backstory):
Endpoint:
http
PATCH https://backstory.googleapis.com/v1/tools/bigqueryAccess:update
Request Body:
json
{
"email": "analyst@yourdomain.com"
}
Response:
json
{
"email": "analyst@yourdomain.com",
"roles": "bigquery.dataViewer, bigquery.jobUser, storage.objectViewer"
}
This automatically assigns the required IAM permissions (roles/bigquery.dataViewer, roles/bigquery.jobUser, roles/storage.objectViewer) to query the managed project.
