Skip to main content
Question

SecOps SOAR Integration via Remote Agent

  • June 8, 2026
  • 2 replies
  • 47 views

toksikwis
Forum|alt.badge.img+1

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.

However, during the integration configuration, when we check "run remotely" and select the remote agent, we are unable to save the config. It's showing error "An error occurred while saving instance configuration". We configured everything as the documentation indicated including the service account mapping. The remote agent container does not show any error. 

2 replies

Eoved
Forum|alt.badge.img+9
  • Bronze 3
  • June 8, 2026

Hi,

I suggest starting by reviewing the agent logs. You can download them from the SecOps UI, or for deeper visibility, access the Docker container and check the logs directly from the agent host under:
/opt/SiemplifyAgent/Logs/

These logs should give a good overall view of the agent’s behavior, including task execution, connector activity, and communication with the platform.

Troubleshoot common issues  |  Google Security Operations  |  Google Cloud Documentation


toksikwis
Forum|alt.badge.img+1
  • Author
  • New Member
  • June 10, 2026

Hi Eoved, 

Thanks for your comment. 
When we download the remote agent logs from the secops web ui (compressed file), it does not contain any logs. we tried to change the logging level from ERROR to info, still no logs was being generated. 

 

We looked at the agent logs (/opt/SiemplifyAgent/Logs/agent.log) as well and we just saw that the agent is fetching task.

 We checked the path (/opt/SiemplifyAgent/Integrations) and saw the integration folder that we deployed, however on the secops ui, it is still getting error when saving. Hence we cannot utlized the integration.