When I run a UDM search directly in Google SecOps, it returns exactly the data I need, including aggregated statistics. However, when I use the 'Execute UDM Query' playbook action, it only returns raw UDM events without any aggregation or statistical summaries. Is there a way to configure the playbook action so that it returns the same aggregated results as a standard SIEM search?
Question
UDM SEARCH
+13Hi
Separately, have you worked with the new SecOps Wrapper SDK? I have not explored your specific use case with it yet but there might be a way to leverage the wrapper instead of this specific playbook action to programmatically return this type of data along with the raw UDM queries, but I would have to experiment with this further on my side.
+8Another option would be to create a custom action using the v1alpha UDMSearch API. This API endpoint does support stat queries.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.