Deploy high availability in remote agents

Supported in:

Google SecOps SOAR

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

To avoid a single point of failure, configure a secondary remote agent as a backup. If the primary agent becomes unavailable, the secondary agent automatically takes over remote execution of actions, jobs, and connectors after a 30-second downtime. If the primary agent fails while executing a task, that task fails and must be manually re-run. All other pending tasks are routed to the secondary agent. Once the primary agent is restored, all jobs, actions, and connectors seamlessly switch back to it.

To set up high availability for remote agents, do the following:

1. Go to SOAR settings > Advanced > Remote Agents.
2. Click View more on the agent you want to set as primary and assign a secondary agent. The side drawer opens with all the information on the agent.
3. Click Add secondary agent. You can create one secondary agent for each primary agent. You cannot use the same secondary agent for two different primary agents.
• If your primary agent is not updated to the latest version, a message prompts you to click Update.
• If your connectors are on an older version, you're prompted to redeploy them to support high availability. For more information, see Redeploy connectors.
4. Follow the process to set up an agent. You can choose to set up the agent using manual installation or a docker. Make sure the secondary agent has the same network or internet access as the primary agent. The status of the secondary agent is shown as live in the High Availability column in the Remote Agents page.
Note: Once you set up high availability, you can only work with the primary agent across the platform. If the primary agent is down, the secondary agent becomes active, ensuring a seamless configuration deployment..

Notifications

You can register for agent notifications for your environments from the Notifications bell. Notifications are triggered only after the remote agent has been down for 90 seconds.

Need more help? Get answers from Community members and Google SecOps professionals.