We, at Foresite, ran into a SecOps authentication error with some instances we support after the recent January 11th SecOps release. https://cloud.google.com/chronicle/docs/secops/release-notes#January_11_2025

The change affected how IDP group names are passed to SecOps for SOAR authentication, preventing access to some instances.

Cause:

The issue arises from the format of group names in "IDP Group Mapping" in SOAR settings. Group names previously required brackets and quotation marks (e.g., ["soar-users"]). This formatting is no longer valid.

Solution:

To regain access, remove the brackets and quotation marks from the group names in "IDP Group Mapping" (e.g., soar-users).

Workarounds for Lost Admin Access:

Create a Matching IDP Group: Create a new group in your IDP that exactly matches the name of an existing group with admin permissions in SOAR.

Contact Google Support: Google Support can also add a group name to restore admin access.