The Remote Agent provides a secure way to connect a cloud Google Security Operations
instance to remote sites. This provides MSSP and enterprise Security Operations Centers
with the following capabilities:
Execute actions and playbooks on remote sites directly from Google SecOps
Pull alerts and security data from remote sites with remote connectors
Connect to remote networks to pull data for incident response purposes
The Remote Agents infrastructure consists of 2 main components:
Google SecOps Platform Deployment of Google SecOps platform to consolidate all security alerts in one place, and orchestrate security and network products with automated workflows.
Google SecOps Agent A remote agent deployed on the remote site. The agent pulls new tasks from Google SecOps, executes remotely (on the remote\separate network) and updates Google SecOps with the results. The agent is easily deployed and lets both enterprise and MSSP end-customers to self deploy it. The agent can initiate communication with Google SecOps to get new commands and to send new alerts and data.
Agent notifications
Agent notifications—such as alerts for new agent versions and agent
downtime—are enabled by default. Notifications for agent downtime are triggered
when a remote agent has been down for more than 90 seconds. You can opt out of
these notifications at any time from your user preferences.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[[["\u003cp\u003eThe Remote Agent enables secure connection between a Google Security Operations instance and remote sites.\u003c/p\u003e\n"],["\u003cp\u003eIt allows execution of actions and playbooks, along with pulling security data and alerts from remote sites directly within Google SecOps.\u003c/p\u003e\n"],["\u003cp\u003eThe system comprises the Google SecOps Platform and the Google SecOps Agent, which is deployed on the remote site.\u003c/p\u003e\n"],["\u003cp\u003eThe agent facilitates remote task execution and updates the Google SecOps platform with results, alerts, and data.\u003c/p\u003e\n"]]],[],null,["# What is a Remote Agent?\n=======================\n\nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc) \n\nThe Remote Agent provides a secure way to connect a cloud Google Security Operations\ninstance to remote sites. This provides MSSP and enterprise Security Operations Centers\nwith the following capabilities:\n\n- Execute actions and playbooks on remote sites directly from Google SecOps\n- Pull alerts and security data from remote sites with remote connectors\n- Connect to remote networks to pull data for incident response purposes\n\nThe Remote Agents infrastructure consists of 2 main components:\n\n**Google SecOps Platform**\n\nDeployment of Google SecOps platform to consolidate all security alerts in one place, and orchestrate security and network products with automated workflows.\n\n**Google SecOps Agent** \nA remote agent deployed on the remote site. The agent pulls new tasks from Google SecOps, executes remotely (on the remote\\\\separate network) and updates Google SecOps with the results. \nThe agent is easily deployed and lets both enterprise and MSSP end-customers to self deploy it. \nThe agent can initiate communication with Google SecOps to get new commands and to send new alerts and data.\n\nAgent notifications\n-------------------\n\nAgent notifications---such as alerts for new agent versions and agent\ndowntime---are enabled by default. Notifications for agent downtime are triggered\nwhen a remote agent has been down for more than 90 seconds. You can opt out of\nthese notifications at any time from your user preferences.\n\nFor more information about downtime notifications and high availability, see\n[Deploy high availability in remote agents](/chronicle/docs/soar/working-with-remote-agents/deploy-high-availability-for-remote-agents).\n\n### Opt out of notifications\n\n1. Click your user avatar and choose **User Preferences**.\n2. Click **Notifications**.\n3. Clear the checkbox next to **Remote Agents** to stop receiving notification alerts.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
