SOAR Data to Bigquery?

The case information is not currently included in this list: https://docs.cloud.google.com/chronicle/docs/reports/export-to-customer-managed-project

Any plans to add it? 😁

​@ar3diu you may want to open a support case to get access to the SOAR BQ data which has this database below. After SOAR phase#2 migration, the data should be there in the BYOP by default. 

https://docs.cloud.google.com/chronicle/docs/reference/soar-bq-schema-reference
 

This document outlines the schema for the siemplify_search_everything_db, a database designed to store and manage data for Google SecOps. This database is published to a BigQuery dataset using BYOBQ (Bring your own BigQuery) to provide the customer raw data for analysis

The database is structured to capture a comprehensive view of security operations, including:

• Alert and case data: Detailed information about security alerts, the cases they are associated with, and their various attributes like networks, products, and tags.
• Playbooks and action results: Information about the execution of automated workflows and playbooks, including their status and results.
• Metadata and configuration: Tables that store configuration data for the Siemplify platform, such as case stages, user profiles, and environment parameters.
• System and sync information: Data related to system actions and the synchronization of data within the platform.

​@hzmndt Thank you for this! Is this exclusive to Ent+? 🤔

I will have to discuss this with our account manager. Thanks for your answers, they were very helpful! 🙏