Use Advanced SOAR reports - Looker

This feature is available for all customers using the Google Security Operations Google Cloud license who have access in the Settings > Permissions page.

Two types of permissions can be assigned to users in the Permissions page:

• View: select the View Advanced Reports checkbox to give users access to view reports in the Advanced Reports tab.
• Edit: select the Allow editing Advanced reports checkbox to permit users to edit, duplicate, share, download, and delete advanced reports.

Advanced Reports are accessible to all platform users through the Reports tab without any prior setup.

The following folders in the Advanced Reports tab are available:

• Default: available for administrators only. Reports in this folder come predefined and can't be edited. However, they can be duplicated and edited in a different folder. For the full list of default reports together with their descriptions, see Default Advanced SOAR reports in depth.
• Personal: reports that you create yourself using the Looker components. You can also duplicate reports from the Default or Shared folders and save them here.
• Shared: reports that you created and shared with others or that others created and shared with you.

Building reports with SOAR Explores

SOAR Explores let you define and visualize specific data by selecting the relevant fields. While the process of creating a report using SOAR Explores is similar to the Looker dashboard process, SOAR Explores include additional fields that are specific to SOAR.

For more information, see Creating Charts and Visualizations.

To view all available Looker Explores and their descriptions, see Using Looker Explores in SOAR Reports.

To create a report using SOAR Explores, follow these steps:

1. Go to Dashboards and Reports > SOAR Reports.
2. Click Advanced Reports.
3. Click add Add report. The Create new report dialog appears.
4. In the Create new report dialog, add a name for the report, and choose a folder and an environment.
5. Click Create. The new report is added to the list of reports in either Personal Reports or Shared Reports folders.
6. Select the report and click Edit Dashboard.
7. Click Add, located under the report name.
8. From the list, select Visualization. The Choose an Explore dialog appears.
9. Choose the relevant SOAR Explore to access data fields specific to your report.
10. In the All Fields tab, choose the dimensions and measures relevant to your report.
11. Once all of the relevant fields are selected, customize your report as needed and click Save. The tile is added to the dashboard.

For more information on how to create and edit Looker reports, see Exploring data in Looker.

Use custom fields in advanced reports

You can use custom fields created in Google SecOps within advanced reports to gain deeper insights into your cases and alerts. To learn how to use custom fields in Looker reports, including LookML formulas and filtering techniques, see Manage Custom Fields.

Share Reports

1. Click share Share.
2. Select the environments for the report that you want to share with Google SecOps users of those environments.
3. If you want to share the report with users who have view-only access, make sure you select the checkbox.

Duplicate Reports

1. Click content_copy Duplicate Report.
2. Select the folder you want to duplicate the report into.
3. Select the required environments.

Rename Looker reports

You can only rename reports that you have created or duplicated and which appear in your personal or shared folder.

1. Open the report you want to rename.
2. Click more_vertDashboard actions, and select Edit dashboard.
3. Place your pointer in the name field and write the new name.
4. Click Save.

Troubleshooting

The following error may appear in the Advanced reports page:

You are not authenticated to view this page

If you see this error, but you're sure that you're authenticated, then your browser is probably blocking Looker cookies. You can enable Looker cookies in your browser to access advanced reports. The process for enabling Looker cookies depends on your browser.

To enable Looker cookies and access the Advanced reports page in Google Chrome, follow these steps:

1. Right-click anywhere on the page and then select Inspect.
2. Click one of the reports and copy the URL to your clipboard.
3. In the Chrome Settings, go to Privacy and Security > Third-party cookies.
4. In the Allowed to use third-party cookies section, click Add and enter the Looker URL.

You should now be able to view the advanced reports.