Both the manual actions and the actions that appear in the playbook are populated after you download the corresponding integration in the Google Security Operations Marketplace.
To perform a manual action, complete the following steps:
In the selected case, click Manual Action; the Manual Action dialog appears.
Select the required action. For example, select VirusTotalV3 > Enrich URL. Complete the required information.
Select the alerts and entities you want the action to run on.
Click Execute; the action details appear on the case wall.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-04-12 UTC."],[],[]]
Manual Action; the Manual Action dialog appears.