Skip to main content

Table of Contents

 

129218iF9415CC398144BCA.png

Google SecOps lets you investigate many different aspects of the information stored in your Google SecOps account. SecOps Investigation lets you to examine the aggregated security information for your enterprise going back for months or longer. Use Google SecOps to search across all of the domains accessed within your enterprise.

 

Actions

129219i1469142C8A269484.png
SIEM Search

The SIEM Search function lets you find events and alerts within your Google SecOps instance. SIEM Search includes a variety of search options that help you to navigate through your data. You can search for individual events and groups of events tied to shared search terms.

 


Steps
  1. Users will navigate to the left-side Navigation Bar and then select Investigation, which will display a dropdown menu.
  2. Select SIEM Search to display the SIEM Search page. 
  3. On the SIEM Search page, users will be able to see a Search Query bar at the top of the page. Users can enter questions in natural language form.
    1. Example: “Find Externally Shared Documents with Confidential in the Title.”
  4. Once a Query is entered, users will select Generate Query. 129223iB0A95AC8D8821E2E.png
  5. The Query will appear in the Terminal box below Search Query, showing Field and Operator.
  6. At the main part of the page, users will see the following options:
    1. Your Search History
    2. Your Saved Searches
    3. Searches Shared With You
  7. Users will have the following options:
    1. Search History (Open Search Manager) 129222i0FA9C7BDBAFA76A3.png
    2. UDM Lookup
    3. Lists 
    4. Feedback on Generated Query
    5. Rewrite Query
    6. Case Sensitivity
    7. Date/ Time Range
    8. Run Search
  8. Once a Query has been generated, users will see three tabs in the main section of the page:
    1. Overview
    2. Events
    3. Alerts
  9. If there are results, a number value will appear next to each section tab.
  10. Overview tab results will show entity Overview data.
  11. Events tab results will show the following details:
    1. Trend Over Time
    2. Prevalence
    3. Filter Options
    4. Aggregations
      • Grouped Fields
      • UDM Fields
    5. Events
      • Timestamp
      • Event
      • User
      • Hostname
      • Process Name
    6. Search Events
  12. To Search for Events, users will enter a query into the Search Events field and select Apply To Search and Run button.
  13. If an event is selected, users will see an Event Viewer to the right of the Event, consisting of:
    1. Entities
    2. UDM Fields
    3. Raw Log w/ option to Manage Parser.
  14. Under the Events Results section, users can download the Queried Events by selecting the Download as CSV button.
Relevant Documentation Links

 

 

129220iCF130F86F9784B2D.png

SOAR Search

The SOAR Search page lets you find specific cases or entities indexed by Google SecOps SOAR. Google SecOps SOAR stores all case and entity information from cases, giving you the ability to retrieve information that may be relevant for what you are investigating.

 


Steps
  1. Users will navigate to the left-side Navigation Bar and then select Investigation, which will display a dropdown menu.
  2. Select SOAR Search to display the SOAR Search page. 
  3. On the SOAR Search page, users will be able to see a Search Query bar at the top of the page.
  4. To the left of the Search Query bar are two dropdown menus to filter between Cases and Entities, and a Date Range filter. 129221i1167BCA1A5B04692.png
  5. On the left-side of the SOAR Search page, is a series of Filter options, each with a dropdown menu.
  6. The Cases Filter options consist of:
    1. Status
    2. Environments
    3. Tags
    4. Users
    5. Category Outcomes
    6. Ports
    7. Products
    8. Case Source
    9. Case Stages
    10. Alert Types
    11. Priorities
    12. Importance
    13. Is Incident
  7. The Entities Filter options consist of:
    1. Networks (Top 20)
    2. Environments (Top 20)
    3. Type
    4. Is Suspicious
    5. Is Internal Asset
    6. Is Enriched
  8. Results for both will appear in the main section of both pages.
Relevant Documentation Links

 

 

Next Step: Security Operations: Step 4.2 - Investigate | Investigate Cases & Alerts 

Previous Step: Security Operations: Step 4 - Investigate 

Be the first to reply!

Reply


Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.