Configure integrations

Supported in:

Google SecOps SOAR

Overview

Integrations are packages that can be installed from the Google Security Operations Marketplace. Installing an integration adds connectors, playbook actions, and scheduled jobs, all of which connect Google Security Operations with third-party products in order to perform relevant tasks.

• Connectors: ingest alerts into Google Security Operations from external sources.
• Actions: enrich data and perform tasks like blocking IP addresses or sending emails.
• Jobs scheduler: performs scheduled tasks on third-party products directly from Google Security Operations.

Install an integration

To install an integration, follow these steps:

1. Go to Marketplace and click the Integrations tab.
2. Search for the integration package you want to install.
3. Click Install.

Note: After installing the integration, connectors, playbook actions, and scheduled tasks must be configured separately.

Configuration

For detailed configuration of each component, refer to the following guides:

• Ingest Your Data with Connectors
• Using Actions in Playbooks
• Writing Jobs
• Configure an Instance

After configuring the integration, test it to ensure that all components are working as expected. Refer to the linked guides for any troubleshooting tips or additional configuration details.