Google Security Operations SOAR Overview

Supported in:

Google Security Operations Security Orchestration, Automation, and Response (SOAR) is an automation platform designed to help organizations streamline and accelerate threat detection, investigation, and response. Built on Google Cloud infrastructure, the platform is designed as a central execution environment for security workflows.

The platform provides a code-driven environment for security engineers to:

  • Unify data ingestion: Collect data from diverse security sources, including network devices, endpoint agents, and threat intelligence feeds.
  • Automate response workflows: Build on Google's machine learning and the platform's Playbook engine to automatically initiate complex response actions.
  • Integrate and extend: Serve as the hub for a comprehensive security solution by integrating with tools like Security Information and Event Management (SIEM), vulnerability scanners, and other security tools.
  • The Google SecOps SOAR platform reduces response times by automating manual tasks, empowering security analysts to rapidly investigate incidents and deploy custom-built automation without requiring extensive frontend coding knowledge.
For more information, see SOAR Table of Contents.

Need more help? Get answers from Community members and Google SecOps professionals.