September 15, 2026

Enrichment Actions

Enrichment actions pull context from external sources to help analysts make faster, better decisions. These run automatically with no approval needed because they are read-only operations.

VirusTotal (via SOAR Marketplace integration):

• Hash lookup: submit a file hash and get detection ratios, malware family classification, and first-seen dates.
• URL reputation: check whether a URL is flagged as malicious, phishing, or suspicious.
• Domain report: pull domain registration history, DNS records, and associated threat indicators.

Google Threat Intelligence (GTI):

• Threat actor context: identify which threat group is associated with observed indicators.
• Campaign information: determine if the activity matches a known campaign with documented TTPs.

WHOIS:

• Domain registration details: registrant info, creation date, name servers. Newly registered domains (under 30 days old) in your logs deserve extra scrutiny.

Chronicle (SecOps itself):

• Search for related events by entity: pivot from a suspicious IP or user to find all associated activity across your environment.

Containment Actions

Containment actions take protective measures to stop an attacker or limit damage. These execute via SOAR integrations with third-party tools. Google SecOps is a SIEM/SOAR platform, not an endpoint agent. It orchestrates containment by calling APIs on the tools that have direct control.

CrowdStrike: Isolate a compromised host using the contain_host action. The host remains powered on and continues logging, but loses network access except to the CrowdStrike cloud.

Google Cloud IAM: Disable a compromised service account with the equivalent of gcloud iam service-accounts disable. This immediately revokes all active tokens issued to that account.

Azure AD: Revoke all active user sessions, forcing re-authentication. Useful when credentials are confirmed compromised.

Network (firewall API integrations): Block a malicious IP at the perimeter by pushing a rule to your firewall management API. This requires a configured integration with your specific firewall vendor (Palo Alto, Fortinet, Check Point, or others).

Every containment action must sit behind a human approval gate. No exceptions for production playbooks.

Escalation Actions

Escalation actions ensure the right people know about the right alerts at the right time.

• SOAR case creation: Auto-create a case with pre-populated fields including alert details, enrichment results, affected entities, and recommended actions.
• Slack or Teams notification: Send an alert summary to a security channel with key context, severity, and a direct link to the case.
• PagerDuty or Opsgenie: Page the on-call responder for critical-severity alerts. Reserve this for alerts that genuinely require immediate human attention.
• Jira ticket creation: Create a ticket with detection details for alerts that need tracking but not immediate response. Useful for medium-severity findings.

Putting It Together

A typical playbook chains these patterns: trigger on a specific detection, run three enrichment actions in parallel (VirusTotal, GTI, Chronicle entity search), present the combined results to an analyst, wait for approval, then execute containment and create a case.