Understanding SOAR Reports

Supported in:

Reports come in useful to justify Return on Investment (ROI) to upper management and to achieve transparency and accountability to customers and fellow colleagues. 

Google Security Operations provides analysts with four predefined Reports and the option to create new ones. You can export and import Reports to other platforms.

The predefined Reports are:

  • Management – SOC status
  • Management – Closed Cases
  • Tier 1 – Open Cases
  • ROI – Analysts Benchmark

To generate a Report:

  1. Go to Dashboards and Reports > SOAR Reports.
  2. Click on the smart_display  icon under the Generate Report column.
  3. In the dialog box, select the required environments to be included in the Report, Time Frame and the document type (Word or PDF).
  4. Click Download.

To schedule a Report:

  1. Select the required report.
  2. In the right of the screen, select the Scheduler and then, click on the add icon.
  3. Switch the toggle on and enter the relevant information in the New Schedule dialog box.
  4. Click Save.

To add a new Report:

  1. Click on the add icon on the top of the screen, enter a relevant name and select a Category in the New Report template dialog box.
  2. Click Create. The Report appears in the list of Reports.

To edit a report:

  1. Click on the required report from the list of reports.
  2. In the right pane in the screen, click Edit.
  3. Click on the add icon and choose one of the following formats: Pie Chart, Vertical Bar, Editor or Table. Depending on what format you choose, a different dialog box will open. For this procedure, let's choose a Pie Chart.
  4. Enter the relevant information. Note that whether you choose Alert or Cases will affect the options in the other fields. In this procedure, we have created a Report based on Alerts coming from Products whereby the case was closed as malicious and the root cause was an External Attack.
    understandingreports8
  5. Click Save.