Skip to main content

Security Command Center Enterprise: Step 4.1.5 - Remediation | Google SecOps | Response

  • Jun 20, 2025 4:32 PM UTC
  • May 22, 2026 9:02 PM UTC
  • 0 replies
  • 111 views
Digital-Customer-Excellence
Staff
Forum|alt.badge.img+7

Table of Contents

 

149412i4FD2CA88F450553D.png

134313iB1AB15238F0F80B4.png

 

Response

Google SecOps Response function provides the analysts a way to respond to cyber threats in minutes, not days. Enable modern, fast, and effective response by combining low-code automation with powerful collaboration.

 

134340i1057C55013322B31.png

Work with Playbooks

Google SecOps Response function provides the analysts a way to respond to cyber threats in minutes, not days. Enable modern, fast, and effective response by combining low-code automation with powerful collaboration.

A playbook is built on triggers, actions, and flows. Once it is triggered, the playbook moves along the actions to a final resolution

 

Steps
  1. Users will navigate to the left-side Navigation Bar and then select Response dropdown menu, then select Playbooks. 
  2. At the top-left of the page, users can select from a dropdown menu, that allows users to choose:
    1. Show All
    2. Playbooks
    3. Blocks
  3. Next users can select Menu. Before clicking on the menu icon to perform bulk actions, make sure to click the edit icon and select the required Playbooks or Blocks. Clicking on the Menu opens up the following action: 134396i10AFE01810EB3C21.png
    1. Export
  4. Export is useful for sending both Playbooks and Playbook Blocks from staging to production server. The Playbooks will be Exported with their customized views attached.
  5. Filter allows users to:
    1. Turn on Playbook Simulator
    2. Show Active Playbooks
    3. Set Priority
    4. Choose Environments
  6. Also in the top-left, below the Menu and Playbook options, is a Search function, that allows users to Search for Playbooks or Blocks.
  7. At the top of main section of the Playbooks page, users will see the top bar of the Playbook Designer.
  8. At the top segment of the Playbook Designer pane, users can use the horizontal toggling button to enable or disable the Playbook. Note: In the SCCE version of SecOps the Playbook Designer is Read Only:
    1. Playbook or Block details
    2. Description
    3. Toggle Activating Playbook Simulator 134397i48BE52C308B15E29.png
    4. Playbook Priority 134398i2B8B9C797E738210.png
    5. Version Control 134399iD1D5FA97D15C84A8.png
    6. Configure Who Can See or Edit Playbook 134400i9121A532B2CFB25B.png
    7. Save Playbook
  9. In the Playbook Simulator, users will have the following features:
    1. Open Step Selection with available options: 134401iFA19A03C98248767.png
      • Triggers
      • Actions
      • Flow
      • Blocks
    2. Fit to Screen
    3. Revert to Default Arrangement
    4. Zoom In (Steps)
    5. Download as PNG File
    6. Undo Changes 
    7. Redo Changes
    8. Playbook Monitoring (Statistics)
    9. Playbook Navigator (All Actions and Flows)
    10. Edit w/ Gemini (AI)
Relevant Documentation Links

 

 

134341i79FBC7520822A2D7.png

Integrations Setup

Google SecOps provides the analysts a way to respond to cyber threats in minutes, not days. Enable modern, fast, and effective response by combining low-code automation with powerful collaboration.

Integrations are packages that can be installed from the Google SecOps Marketplace. When you install an integration, you are adding connectors, playbook actions and scheduled jobs. These are all able to connect Google SecOps with third-party products in order to perform tasks.

 

Steps
  1. Integrations are configured under Integrations Setup. Users will navigate to the left-side Navigation Bar and then select Response dropdown menu, then select Integrations Setup. 
  2. At the top-left of the page, users will see side panel with two predefined options: Default Environments and Shared Instances, that contains the user’s Integrations. 
  3. In the side panel, users will have the options:
    1. Hide Empty Environments
    2. Filter Environments
      • Environments
      • Integrations
      • Configured
      • Remote Integrations
    3. Search Bar 
    4. List of Environments and Instances
  4. In the main page of each Environments option, users will be able to see their Integrations, to include the following options:
    1. Search Field
    2. Create a New Instance 134402i7F081A72EFC53782.png
    3. Read More (about the Integration)
    4. Configured/ Not Configured
    5. Configure Instance 134403iCCEE33142BA434EF.png
    6. Delete Instance 134404i529F1BE24D26643B.png
  5. If a user needs to Configure an Instance, click the Configure Instance button. In both current or new Instances, users can configure the following sections:
    1. Instance Name 
    2. Description
    3. Parameters
      • The Parameters has several options available depending on the Instance.
    4. Test
    5. Save
Relevant Documentation Links

 

 

134342i4EC3168DE41D62FF.png

Jobs Scheduler

Google SecOps provides the analysts a way to respond to cyber threats in minutes, not days. Enable modern, fast, and effective response by combining low-code automation with powerful collaboration.

The Jobs Scheduler page contains default Google SecOps jobs, as well as jobs that are created in the IDE and are essentially scripts that can be scheduled to run periodically. Jobs can access data in all environments.

 

Steps
  1. Jobs are configured under Jobs Scheduler. Users will navigate to the left-side Navigation Bar and then select Response dropdown menu, then select Jobs Scheduler.
  2. At the top-left of the page, users will see side panel with the following options:
    1. Refresh
    2. Show All/ Hide Inactive 134405i056CFB17723D1799.png
    3. Search Field
    4. Expand/ Collapse List
    5. Jobs List
  3. When a user wants to display current Jobs, whether Active/ Inactive, click on a Job and the selected Job page will appear.
  4. The Job page will consist of the following information:
    1. Job Activation Toggle
    2. Job Name
    3. Job Creation Date/ Time 
    4. Job Description
    5. Job Menu
      • Download Job
    6. Job Details
    7. Job Parameters
    8. Job History
    9. Run Now
Relevant Documentation Links

 

 

Dashboards & Reports

Google SecOps provides you the type of visualization required to maintain awareness of security events, the SOC environment, and case information in one product. Being able to communicate with your team and peers in security in an instant enables your team to effectively manage threats. Visualization can be a game changer. With Google SecOps’ Dashboards and Reports, users can visualize their Security Environment with ease.

 

134343iF951074511F2086F.png

SIEM Dashboards

Google SecOps’ Dashboard page enables analysts to manage dashboards, giving them an overview of the specified data in various views in the form of widgets. A dashboard holds a maximum of 12 widgets, which can display data in various forms such as pie charts, horizontal or vertical bars, tables, ROI charts, etc., for any specified SOC environment or case occurrence time.

 

Steps
  1. Users will navigate to the left-side Navigation Bar and then select from the Dashboards and Reports dropdown menu.
  2. Users will then select SIEM Dashboards from the dropdown menu, which will display the SIEM Dashboards available. 
  3. The SIEM Dashboard page sidebar will display the following options:
    1. Default Dashboards
    2. Personal Dashboards
    3. Shared Dashboards
  4. If there are no Dashboards available, or the user would like to add a Dashboard, select the Add button, next to Personal Dashboards or Shared Dashboards.
  5. In the Add Dashboard dropdown menu, users can select to:
    1. Create New 
    2. Import Dashboard
  6. At the top-right of the SIEM Dashboards page, users can select to:
    1. Reload the page
    2. Hide Filters
  7. In the Dashboard Actions selection, users can choose to: 134406i7395A60938D90E96.png
    1. Clear Cache and Refresh
    2. Download
    3. Schedule Delivery
    4. Reset Filters
  8. In the Default Dashboards, users will see the pre-defined Dashboards consisting of:
    1. Cloud Detection & Response- Overview
    2. Context Aware Detections- Risk
    3. Data Ingestion and Health
    4. IOC Matches
    5. Main
    6. Rule Detections
    7. User Sign In Overview
Relevant Documentation Links

 

 

134344i08E55069D9ABD00F.png

SOAR Dashboards

Google SecOps’ Dashboard page enables analysts to manage dashboards, giving them an overview of the specified data in various views in the form of widgets. A dashboard holds a maximum of 12 widgets, which can display data in various forms such as pie charts, horizontal or vertical bars, tables, ROI charts, etc., for any specified SOC environment or case occurrence time.

 

Steps
  1. Users will navigate to the left-side Navigation Bar and then select from the Dashboards and Reports dropdown menu.
  2. Users will then select SOAR Dashboards from the dropdown menu, which will display the SOAR Dashboards available. 
  3. The SOAR Dashboard page will display the selected Dashboard, which can be selected from the Dashboard Selection menu at the top-left of the page. Below the Dashboard Selection menu, users can see the Owner of the Dashboard.
  4. On the top-right of the Dashboard, users will see:
    1. Filter Option
      • Time Range
      • Environment
    2. Menu 134407i03E952470DDCAE04.png
      • Share Dashboard with Others
      • Export
      • Save as a Report Template
      • Delete Dashboard
    3. Refresh 134413i30F5B5D77805B51D.png
    4. Import 134409iFBC5B8980EE302C4.png         
    5. Add Widget 134410i4FF7133D70A82DBE.png
Relevant Documentation Links

 

 

134345i64575E4362D9C9AD.png

SOAR Reports

Google SecOps Reports can be used to justify Return on Investment (ROI) to upper management and to achieve transparency and accountability to customers and fellow colleagues. 

Google SecOps provides analysts with five predefined Reports and the option to create new ones. You can export and import Reports to other platforms.

 

Steps
  1. Users will navigate to the left-side Navigation Bar and expand the Dashboards and Reports dropdown menu.
  2. Users will then select SOAR Reports and SOAR Reports page will appear. 
  3. Users will see five pre-defined reports templates available:
    1. General
    2. Management
    3. ROI
    4. SLA
    5. Tier 1
  4. Users can select the following options at the top of the Reports page:
    1. Search field
    2. Menu 
    3. Refresh
    4. Import 
    5. Add New Template
  5. Users will see a list of available reports under the following columns:
    1. Category
    2. Name of Template
    3. Created By
    4. Creation Time
    5. Scheduler
    6. Generate Report 134411i40649F7E0787FF07.png
  6. When a Report is selected, users will see an Editor and Scheduler section to the right of the Report List. 
  7. When a user selects a Report, the Widgets that the user wants in the Report can be edited by selecting the Edit Widget button 134412iDD0D77D3DF1C8F91.png, which will appear when the user’s mouse hovers over the Widget they choose to Edit. 
  8. Additionally, users can delete Widgets by selecting the Delete button, next to the Edit Widget button.
  9. To Schedule a Report, users will select the Scheduler section and click on the Add New Schedule button.
  10. To Generate a Report, users will select a listed Report and click Generate, which will display a Generate Report popup.
  11. In the Generate Report popup, users will select the following options:
    1. Environments
    2. Time Frame
    3. File Type
  12. When complete, users will select Download. The Report will appear in the user’s download folder, available to disseminate.
Relevant Documentation Links

 

 

 

You have completed your Google Security Command Center Enterprise Onboarding Journey!

You'll find comprehensive guides and documentation to help you start working with Google Security Command Center Enterprise as quickly as possible, as well as support if you get stuck.

For those who seek to learn more, feel free to search and discover more about the platform in our Google Security Command Center Enterprise Documentation Hub located here.

 

Previous Step: Security Command Center Enterprise: Step 4.1.4 - Remediation | Google SecOps | Investigation 

    Terms & ConditionsAccessibility statement
    Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

    © 2025 Google. All rights reserved.