Using Advanced SOAR Reports

This feature is available for all customers using the Google Security Operations Google Cloud license who have been given access in the Settings > Permissions screen.

Two types of permissions can be assigned to users in the Permissions screen:
View - users will only see reports that were shared with them in the Shared folder, they can also download reports and filter reports.

Edit - users can duplicate reports to the shared and personal folders, share reports, edit reports, download reports, and delete shared reports.

Advanced Reports can be accessed by all platform users through the Reports tab with no need for any prior setup.

The following folders in the Advanced Reports tab are available: 

Default: Available for Admins only. Reports in this folder come predefined and cannot be edited. However, they can be duplicated and edited in a different folder. The full list of default reports together with their descriptions can be seen here.

Personal: these are Reports that you create yourself using the Looker components. You can also duplicate reports from the Default or Shared folders and save them here.

Shared: these are reports that either you created and shared with others - or that others created and shared with you.

Create a Report

  1. Click the add icon.
  2. Add name of report and choose a folder and an environment.
  3. Click Create.
    For full information on how to create and edit Looker reports, click here.
     


Share Reports

  1. Click the Share icon share  on the top right of the screen.
  2. Select the environments for the report that you want to share with Google Security Operations users of those environments.
  3. If you want to share the report with users who have view only access, make sure to select the checkbox.

Duplicate Reports

  1. Click the Duplicate icon content_copy on the top right of the page.
  2. Select the folder you want to duplicate the report into. 
  3. Select the required environments.

Rename Looker reports

You can only rename reports that you have created or duplicated and which appear in your personal or shared folder.

  1. Open the report you want to rename.
  2. From the more_vert Dashboard actions menu, select Edit dashboard.
  3. Place your pointer in the name field and write the new name.
  4. Click Save.

Troubleshooting

The following error may appear in the Advanced reports page:

You are not authenticated to view this page

If you see this error, but you're sure that you're authenticated, then your browser is probably blocking Looker cookies. You can enable Looker cookies in your browser to access advanced reports. The process for enabling Looker cookies depends on your browser.

To enable Looker cookies and access the Advanced reports page in Google Chrome, follow these steps:

  1. Right-click anywhere on the page and then select Inspect.
  2. Click one of the reports and copy the URL to your clipboard.
  3. In the Chrome Settings, navigate to Privacy and Security > Third-party cookies .
  4. In the Allowed to use third-party cookies section, click Add and enter the Looker URL.

You should now be able to view the advanced reports.