Using Advanced SOAR reports

Supported in:

This feature is available for all customers using the Google Security Operations Google Cloud license who have been given access in the Settings > Permissions page.

Two types of permissions can be assigned to users in the Permissions page:

  • View: Select the View Advanced Reports checkbox to give users access to view reports in the Advanced Reports tab.
  • Edit: Select the Allow editing Advanced reports checkbox to permit users to edit, duplicate, share, download, and delete advanced reports.

Advanced Reports can be accessed by all platform users through the Reports tab with no need for any prior setup.

The following folders in the Advanced Reports tab are available:

  • Default: Available for administrators only. Reports in this folder come predefined and cannot be edited. However, they can be duplicated and edited in a different folder. For the full list of default reports together with their descriptions, see Default Advanced SOAR Reports In Depth.
  • Personal: These are reports that you create yourself using the Looker components. You can also duplicate reports from the Default or Shared folders and save them here.
  • Shared: These are reports that either you created and shared with others or that others created and shared with you.

Building reports with SOAR Explores

SOAR Explores allow you to define and visualize specific data, by selecting the relevant fields. While the process of creating a report using SOAR Explores is similar to the Looker dashboard process, SOAR Explores include additional fields that are specific to SOAR.

For more information, see Creating Charts and Visualizations.

To view all available Looker Explores and their descriptions, see Using Looker Explores in SOAR Reports.

To create a report using SOAR Explores, follow these steps:

  1. Navigate to Dashboards and Reports > SOAR Reports.
  2. Click the Advanced Reports tab.
  3. Click add Add report. The Create new report dialog appears.
  4. In the Create new report dialog, add a name for the report, and choose a folder and an environment.
  5. Click Create. The new report is added to the list of reports in either Personal Reports or Shared Reports folders.
  6. Select the report and click Edit Dashboard.
  7. Click Add, located under the report name.
  8. From the drop-down, select Visualization. The Choose an Explore dialog appears.
  9. Choose the relevant SOAR Explore to access data fields specific to your report.
  10. In the All Fields tab, choose the dimensions and measures relevant to your report.
  11. Once all of the relevant fields are selected, customize your report as needed and click Save. The tile is added to the dashboard.

For full information on how to create and edit Looker reports, see Exploring data in Looker.

Share Reports

  1. Click share .
  2. Select the environments for the report that you want to share with Google Security Operations users of those environments.
  3. If you want to share the report with users who have view-only access, make sure to select the checkbox.

Duplicate Reports

  1. Click content_copy Duplicate Report.
  2. Select the folder you want to duplicate the report into.
  3. Select the required environments.

Rename Looker reports

You can only rename reports that you have created or duplicated and which appear in your personal or shared folder.

  1. Open the report you want to rename.
  2. Click more_vertDashboard actions, and select Edit dashboard.
  3. Place your pointer in the name field and write the new name.
  4. Click Save.

Troubleshooting

The following error may appear in the Advanced reports page:

You are not authenticated to view this page

If you see this error, but you're sure that you're authenticated, then your browser is probably blocking Looker cookies. You can enable Looker cookies in your browser to access advanced reports. The process for enabling Looker cookies depends on your browser.

To enable Looker cookies and access the Advanced reports page in Google Chrome, follow these steps:

  1. Right-click anywhere on the page and then select Inspect.
  2. Click one of the reports and copy the URL to your clipboard.
  3. In the Chrome Settings, navigate to Privacy and Security > Third-party cookies.
  4. In the Allowed to use third-party cookies section, click Add and enter the Looker URL.

You should now be able to view the advanced reports.