Testing the connector

In this section we will show an example of an alert that is ingested into the Google Security Operations platform.

1. Insert a malicious email into the platform.

2. Copy the text below and send this email from another user:

   Subject: Your New Salary Notification

   Email body:
   Hello, You have an important email from the Human Resources Department with regards to your December 2018 Paycheck
   This email is enclosed in the Marquette University secure network.
   Access the documents here www.example.com
   Ensure your login credentials are correct to avoid cancellations
   Faithfully
   Human Resources
   University of California, Berkeley

3. Navigate to the 'Testing' tab and test your connector by clicking the button 'Run connector once' and view the result in the "Output" section on the right.
   If your connector runs successfully you will see an alert which is a single unread email message that the connector ingested (make sure that you have an unread email in your mailbox to insert a sample alert).
   
4. You can see a preview of the email by clicking on the preview icon.
   
5. After ingesting a sample alert by clicking "Run connector once", we will ingest the alert into the case queue by selecting the alert and clicking "Load to system".
   
6. Navigate to the Cases tab to view the case you have ingested into the Google SecOps platform.
   
7. After the connector receives the email by translating the email data to Google SecOps data, we can see our alert in the "Cases" tab in the case queue.

When the case first appears in the system, it is not mapped and modeled. This will be done in the next step.

Next, we will see how each field in the code corresponds to the relevant field presented in the context details in the platform itself. Click on the alert to view the Alert Context details on the right.