High availability in remote agents

Supported in:

Google SecOps SOAR

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

To prevent a single point of failure when using the remote agent, you can configure a secondary remote agent which will act as a fallback agent for remote actions execution and remote data ingestion. The remote agent will initiate the switch-over to the secondary remote agent after 30 seconds downtime of the primary agent.

Note: The high availability feature supports jobs and actions but not connectors.

How to set up high availability for remote agents

1. Go to SOAR settings > Advanced > Remote Agents.
2. Click View more on the agent you want to assign as primary. The side drawer opens with all the information on the agent.
3. Click Add secondary agent.
4. Follow the process to set up an agent. You can choose to set up the agent using manual installation or a docker. Make sure the secondary agent has the same network or internet access as the primary agent.
5. The status of the secondary agent is now reflected in the High Availability column in the Remote Agents page.
Note: You can only work with the primary agent throughout the platform. If the primary agent is down, the secondary agent will be live such that the configuration will be seamlessly deployed.