Understand SOAR Reports

Reports are useful for justifying Return on Investment (ROI) to upper management and to achieve transparency and accountability to customers and colleagues. 

Google Security Operations provides analysts with four predefined reports and the option to create new ones. You can also export and import reports to other platforms.

The predefined reports are:

• Management – Soc Status
• Management – Closed Cases
• Tier 1 – Open Cases
• ROI – Analysts Benchmark

Generate a report

1. Go to Dashboards & Reports > SOAR Reports.
2. Click Generate under the Generate Report column.
3. In the Generate report dialog, select the Environments, Time Frame, and File type (PDF or Word).
4. Click Download.
   

Schedule a report

1. Select the required report.
2. Select the Scheduler tab, and click add Add.
   
3. In the New Schedule dialog that appears, click the Enable toggle to turn on the Scheduler, and enter the relevant information.
4. Click Save.

Add a new report

1. Click add Add new template.
2. In the New report template dialog that appears, enter a relevant name, and select a Category from the menu.
3. Click Create.

The report appears in the list of reports.

Edit a report

1. Select the required report from the list of reports.
2. Select the Edit tab.
   
3. Click add Add and choose one of the following formats: Editor, Pie Chart, Table, or Vertical Bar. A dialog appears based on the selected format. For this example, select Pie Chart.
4. Enter the relevant information. Note that selecting Alerts or Cases affects the options in the other fields. In this example, we created a report based on alerts coming from products where the case was closed as malicious, and the root cause was an external attack.

5. Click Save.