Google SecOps

Details
Content
Dependencies
Version History

Retrieve Google SecOps detections, impacted assets, IOC matches, and 3P alerts to enrich your XSOAR workflows.

Quickly respond to security incidents by integrating Google SecOps with Palo Alto Networks Cortex XSOAR.

Google SecOps is a cloud service, built as a specialized layer on top of core Google infrastructure, designed for enterprises to privately retain, analyze, and search the massive amounts of security and network telemetry they generate. Google SecOps normalizes, indexes, correlates, and analyzes the data to provide instant analysis and context on risky activity.

Google SecOps instances, APIs and search parameters are all accessible directly within Cortex XSOAR for full automation of playbooks.

For more information, please visit https://chronicle.security/products/platform/

Quickly respond to security incidents by integrating Google SecOps with Palo Alto Networks Cortex.

Google SecOps instances, APIs and search parameters are all accessible directly within Cortex for full automation of playbooks.

For more information, please visit https://chronicle.security/products/platform/

Automations

Name	Description
ChronicleAssetIdentifierScript	Collect all asset identifiers - Hostname, IP address and MAC address in the context.
ChronicleAssetEventsForMACWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.
ChroniclePotentiallyBlockedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.
ChronicleIsolatedHostnameWidgetScript	Notifies if the hostname associated with the ChronicleAsset is isolated or not.
ChronicleDBotScoreWidgetScript	Shows the DBot Score and reputation of the Domain.
ExtractDomainFromIOCDomainMatchRes	Extracts domain and its details from the Chronicle IOC Domain match response.
ChronicleIsolatedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is isolated or not.
ChronicleListDeviceEventsByEventTypeWidgetScript	Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.
ConvertDomainToURLs	Converts Domain(s) to URL(s).
ChronicleAssetEventsForIPWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.
ChronicleAssetEventsForHostnameWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.
ChronicleAssetEventsForProductIDWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.
GoogleSecOpsSyncCaseInformation	Syncs the latest case information, related alerts and alert entities from Google SecOps and updates the Cortex XSOAR incident data.
ListDeviceEvents	List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.
ChronicleDomainIntelligenceSourcesWidgetScript	Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.

Classifiers

Name	Description
Chronicle - Classifier	Classifies Chronicle incidents
Chronicle - Incoming Mapper	Maps incoming Chronicle incident fields.
Google SecOps Cases - Incoming Mapper	Maps incoming Google SecOps Case incident fields.

Incident Fields

Name	Description
Google SecOps Case ID	The unique identifier of the Google SecOps case.
Chronicle Rule ID	Identifier for the rule generating the detection.
Chronicle Detection Window End Time	The end time of the window the detection was found in.
Chronicle Rule Type	Whether the rule generating this detection is a single event or multi-event rule.
Chronicle IOC Ingest Time	IOC ingest time fetched from the Chronicle IOC Domain Matches.
Google SecOps Important	Indicates whether the incident is marked as important.
Google SecOps Stage	The current stage of the incident.
Google SecOps Closure Reason	The reason for closing the incident.
Google SecOps Alert Count	The number of alerts associated with the incident.
Chronicle Domain Name	Domain name fetched from the Chronicle IOC Domain Matches.
Google SecOps Status	The current status of the incident.
Chronicle Alert Name	The name of the alert.
Google SecOps Source	The source from which the incident originated.
Google SecOps SLA Expiration Time	The SLA expiration timestamp for the incident.
Google SecOps Alert Details	Details of alerts associated with the Google SecOps incident.
ChronicleAsset Support Contact	The support email address of the chronicle asset.
Chronicle Events	List of chronicle UDM events.
Google SecOps Score	The risk or severity score of the incident.
Chronicle Detection Time	The time period the detection was found in.
Google SecOps Priority	The priority level of the incident.
Google SecOps Alerts SLA Status	The SLA compliance status of the alerts.
Chronicle Skip Entity Isolation	Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.
Google SecOps Incident	Indicates whether the case has an associated incident.
Chronicle Detection Window Start Time	The start time of the window the detection was found in.
Google SecOps Description	A detailed description of the incident.
Chronicle Auto Block Entities	Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.
Chronicle Detection ID	Identifier for the detection.
Google SecOps Environment	The environment in which the incident was detected.
Chronicle Curated Events	List of chronicle UDM events from curated rule detections.
Google SecOps Alerts SLA Remaining Time Since Last Pause	The SLA remaining time calculated since the last pause for the alerts.
Google SecOps SLA Remaining Time Since Last Pause	The SLA remaining time calculated since the last pause.
Chronicle DBot Score	DBot Score obtained for the IOC Domain Matches fetched from Chronicle
Google SecOps Products
Chronicle Rule Version	Identifier for the rule version generating the detection.
Google SecOps Last Modified User	User who last modified the case.
Google SecOps SLA Status	The SLA compliance status of the incident.
Chronicle Detection Type	Type of detection.
Chronicle Alert Count	The number of times alerts occur.
Google SecOps Assignee	The user assigned to the incident.
Google SecOps SLA Critical Expiration Time	The critical SLA expiration timestamp for the incident.
Chronicle Detection Created Time	Time the detection was created.
Google SecOps Playbook Status	The execution status of the playbook associated with the incident.
Google SecOps Alerts SLA Expiration Time	The SLA expiration timestamp for the alerts.
Google SecOps Closure Action	The action taken when the incident was closed.
Google SecOps Tasks	Tasks linked to the incident.
Chronicle Last Seen	The Alert/IOC Domain was most recently seen within your enterprise.
Google SecOps Alerts SLA Critical Expiration Time	The critical SLA expiration timestamp for the alerts.
Google SecOps Overflow Case	Indicates whether this is an overflow case.
Google SecOps Type	The type or category of the incident.
Chronicle First Seen	The Alert/IOC Domain was first seen within your enterprise.
Google SecOps Update Time	The timestamp of the last update to the incident.
Chronicle Detection State	Indicates whether the rule generating this detection currently has alerting enabled or disabled.
Google SecOps Last Modified User ID	The ID of the user who last modified the incident.
Chronicle Source Product	The source of the alert.
Google SecOps Closure Comment	Additional comments provided at incident closure.
Google SecOps Entity Details	Entity details associated with the Google SecOps case.
Chronicle User	The unique identifier of the user.
Google SecOps Closure Root Cause	The root cause identified at incident closure.
Chronicle Rule Name	Name of the rule generating the detection.
Google SecOps Involved Suspicious Entity	Suspicious entities involved in the incident.

Incident Types

Name	Description
Chronicle Curated Rule Detection
Chronicle Asset Alert
Chronicle Rule Detection
Chronicle IOC Domain Matches
Chronicle User Alert
Google SecOps Case

Indicator Fields

Name	Description
Chronicle Isolated Hostname	Determines if the host is isolated.
Chronicle Potentially Blocked IP	Determines if the IP Address is potentially blocked.
ChronicleAssetMAC
ChronicleAssetHostname
ChronicleAsset Summary	Summary of the event types of the events fetched for all the possible asset identifiers.
Chronicle Isolated IP	Determines if the IP Address is isolated.
ChronicleAssetProductID
ChronicleAssetIP

Integrations

Name	Description
Google SecOps Cases (Partner Contribution)	Use the Google SecOps Cases integration to retrieve Cases as Incidents. This integration also provides commands to manage the Cases lifecycle.
Google SecOps Streaming API (Partner Contribution)	Use the Google SecOps Streaming API integration to ingest detections created by both user-created rules and Google SecOps Rules as XSOAR incidents.
Google SecOps v1 Alpha (Partner Contribution)	Use the Google SecOps integration to retrieve IOC Domain matches as Incidents. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Chronicle (Partner Contribution)	Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

Layouts

Name	Description
Chronicle Curated Rule Detection Incident	Chronicle Curated Rule Detection Incident Layout
Google SecOps Case	Google SecOps Case Layout
Chronicle Rule Detection Incident	Chronicle Rule Detection Incident Layout
Chronicle User Alert Incident	Chronicle User Alert Incident Layout
ChronicleAsset Indicator	ChronicleAsset Indicator Layout

Playbooks

Name	Description
ChronicleAsset Investigation - Chronicle	This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.
Threat Hunting - Chronicle	Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them. Supported Integrations: Chronicle Google SecOps Whois
Case Investigation - Google SecOps	This playbook investigates a Google SecOps case by retrieving the latest case information, related alerts, and their entities, and updating the case stage. It also calculates severity from IOC scores, updates the incident and case priority accordingly, creates entities in the case from the identified IOCs, and posts a summary comment on the case.
ChronicleAssets Investigation And Remediation - Chronicle	Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.
Investigate On Bad Domain Matches - Chronicle	Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: Chronicle Google SecOps Whois Mail Sender (New) Palo Alto Networks PAN-OS Palo Alto Networks AutoFocus v2
IOC Enrichment and Blocking - Google SecOps	This playbook enriches IOCs using the enrichment commands (IP, Email, Domain, URL, and File) and blocks the malicious IOCs based on DBot Score.
Hostname And IP Address Investigation And Remediation - Chronicle	This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.
List Device Events - Chronicle	This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them. Supported integration: Chronicle Google SecOps.

Indicator Types

Name	Description
ChronicleAsset

Automations

Name	Description
GoogleSecOpsSyncCaseInformation	Syncs the latest case information, related alerts and alert entities from Google SecOps and updates the Cortex incident data.
ChronicleAssetEventsForHostnameWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.
ChronicleAssetEventsForProductIDWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.
ChronicleAssetEventsForIPWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.
ChronicleAssetEventsForMACWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.
ChronicleIsolatedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is isolated or not.
ChronicleListDeviceEventsByEventTypeWidgetScript	Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.
ChronicleDomainIntelligenceSourcesWidgetScript	Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.
ChronicleAssetIdentifierScript	Collect all asset identifiers - Hostname, IP address and MAC address in the context.
ChronicleIsolatedHostnameWidgetScript	Notifies if the hostname associated with the ChronicleAsset is isolated or not.
ConvertDomainToURLs	Converts Domain(s) to URL(s).
ChroniclePotentiallyBlockedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.
ExtractDomainFromIOCDomainMatchRes	Extracts domain and its details from the Chronicle IOC Domain match response.
ChronicleDBotScoreWidgetScript	Shows the DBot Score and reputation of the Domain.
ListDeviceEvents	List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Classifiers

Name	Description
Chronicle - Classifier	Classifies Chronicle incidents
Chronicle - Incoming Mapper	Maps incoming Chronicle incident fields.
Google SecOps Cases - Incoming Mapper	Maps incoming Google SecOps Case incident fields.

Incident Fields

Name	Description
Google SecOps Alerts SLA Expiration Time	The SLA expiration timestamp for the alerts.
Google SecOps Alert Count	The number of alerts associated with the incident.
Chronicle Alert Count	The number of times alerts occur.
Google SecOps Closure Action	The action taken when the incident was closed.
Chronicle IOC Ingest Time	IOC ingest time fetched from the Chronicle IOC Domain Matches.
Chronicle Source Product	The source of the alert.
Google SecOps Status	The current status of the incident.
Google SecOps Important	Indicates whether the incident is marked as important.
Google SecOps SLA Status	The SLA compliance status of the incident.
Chronicle Alert Name	The name of the alert.
Google SecOps Involved Suspicious Entity	Suspicious entities involved in the incident.
Chronicle Detection Type	Type of detection.
Chronicle Rule Version	Identifier for the rule version generating the detection.
Google SecOps Alerts SLA Critical Expiration Time	The critical SLA expiration timestamp for the alerts.
Google SecOps Alerts SLA Remaining Time Since Last Pause	The SLA remaining time calculated since the last pause for the alerts.
Google SecOps Priority	The priority level of the incident.
Google SecOps Last Modified User ID	The ID of the user who last modified the incident.
Google SecOps Closure Reason	The reason for closing the incident.
Google SecOps Products
Google SecOps SLA Expiration Time	The SLA expiration timestamp for the incident.
Chronicle Auto Block Entities	Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.
Google SecOps Closure Root Cause	The root cause identified at incident closure.
Google SecOps Update Time	The timestamp of the last update to the incident.
Google SecOps SLA Remaining Time Since Last Pause	The SLA remaining time calculated since the last pause.
Google SecOps Playbook Status	The execution status of the playbook associated with the incident.
Chronicle Detection Window End Time	The end time of the window the detection was found in.
Chronicle Detection ID	Identifier for the detection.
Chronicle Detection State	Indicates whether the rule generating this detection currently has alerting enabled or disabled.
Google SecOps Overflow Case	Indicates whether this is an overflow case.
Google SecOps Source	The source from which the incident originated.
Google SecOps Tasks	Tasks linked to the incident.
Chronicle Last Seen	The Alert/IOC Domain was most recently seen within your enterprise.
Google SecOps Description	A detailed description of the incident.
Google SecOps Environment	The environment in which the incident was detected.
Google SecOps Score	The risk or severity score of the incident.
Google SecOps SLA Critical Expiration Time	The critical SLA expiration timestamp for the incident.
Google SecOps Last Modified User	User who last modified the case.
Chronicle Detection Created Time	Time the detection was created.
Chronicle Rule Type	Whether the rule generating this detection is a single event or multi-event rule.
Google SecOps Entity Details	Entity details associated with the Google SecOps case.
Google SecOps Incident	Indicates whether the case has an associated incident.
Google SecOps Type	The type or category of the incident.
Google SecOps Closure Comment	Additional comments provided at incident closure.
Chronicle Rule Name	Name of the rule generating the detection.
Google SecOps Stage	The current stage of the incident.
Chronicle Curated Events	List of chronicle UDM events from curated rule detections.
Chronicle Skip Entity Isolation	Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.
Google SecOps Assignee	The user assigned to the incident.
Google SecOps Alert Details	Details of alerts associated with the Google SecOps incident.
Chronicle Events	List of chronicle UDM events.
Google SecOps Alerts SLA Status	The SLA compliance status of the alerts.
Chronicle DBot Score	DBot Score obtained for the IOC Domain Matches fetched from Chronicle
ChronicleAsset Support Contact	The support email address of the chronicle asset.
Google SecOps Case ID	The unique identifier of the Google SecOps case.

Incident Types

Name	Description
Chronicle Rule Detection
Chronicle Curated Rule Detection
Google SecOps Case
Chronicle IOC Domain Matches
Chronicle User Alert
Chronicle Asset Alert

Indicator Fields

Name	Description
Chronicle Isolated Hostname	Determines if the host is isolated.
ChronicleAssetHostname
ChronicleAssetMAC
ChronicleAssetProductID
ChronicleAssetIP
Chronicle Potentially Blocked IP	Determines if the IP Address is potentially blocked.
ChronicleAsset Summary	Summary of the event types of the events fetched for all the possible asset identifiers.
Chronicle Isolated IP	Determines if the IP Address is isolated.

Integrations

Name	Description
Google SecOps Streaming API (Partner Contribution)	Use the Google SecOps Streaming API integration to ingest detections created by both user-created rules and Google SecOps Rules as XSOAR incidents.
Chronicle (Partner Contribution)	Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Google SecOps Cases (Partner Contribution)	Use the Google SecOps Cases integration to retrieve Cases as Incidents. This integration also provides commands to manage the Cases lifecycle.
Google SecOps v1 Alpha (Partner Contribution)	Use the Google SecOps integration to retrieve IOC Domain matches as Incidents. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

Layouts

Name	Description
ChronicleAsset Indicator	ChronicleAsset Indicator Layout

Playbooks

Name	Description
ChronicleAsset Investigation - Chronicle	This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.
Investigate On Bad Domain Matches - Chronicle	Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: Chronicle Google SecOps Whois Mail Sender (New) Palo Alto Networks PAN-OS Palo Alto Networks AutoFocus v2
List Device Events - Chronicle	This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them. Supported integration: Chronicle Google SecOps.
Hostname And IP Address Investigation And Remediation - Chronicle	This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.
IOC Enrichment and Blocking - Google SecOps	This playbook enriches IOCs using the enrichment commands (IP, Email, Domain, URL, and File) and blocks the malicious IOCs based on DBot Score.
Threat Hunting - Chronicle	Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them. Supported Integrations: Chronicle Google SecOps Whois
ChronicleAssets Investigation And Remediation - Chronicle	Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.
Case Investigation - Google SecOps	This playbook investigates a Google SecOps case by retrieving the latest case information, related alerts, and their entities, and updating the case stage. It also calculates severity from IOC scores, updates the alert and case priority accordingly, creates entities in the case from the identified IOCs, and posts a summary comment on the case.

Indicator Types

Name	Description
ChronicleAsset

Required Content Packs (10)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
NIST	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
SANS	By: Cortex XSOAR
Sixgill Darkfeed - Annual Subscription	By: Cybersixgill

Optional Content Packs (47)

Pack Name	Pack By
APIVoid	By: Cortex XSOAR
AbuseIPDB	By: Cortex XSOAR
AlienVault OTX	By: Cortex XSOAR
Anomali ThreatStream	By: Cortex XSOAR
AutoFocus by Palo Alto Networks	By: Cortex XSOAR
Awake Security	By: Cortex XSOAR
Barracuda	By: Harri Ruuttila
Cisco Umbrella Investigate	By: Cortex XSOAR
CrowdStrike Falcon Intel	By: Cortex XSOAR
CyberTotal	By: CyCraft Technology Corporation.
DomainTools Enterprise (Deprecated)	By: DomainTools
DomainTools Iris Investigate	By: DomainTools
EclecticIQ Platform	By: EclecticIQ
Flashpoint	By: Flashpoint
Gmail	By: Cortex XSOAR
Gmail Single User	By: Cortex XSOAR
HelloWorld	By: Cortex XSOAR
Ipstack	By: Cortex XSOAR
JsonWhoIs	By: Cortex XSOAR
MISP	By: Cortex XSOAR
Mail Sender (New)	By: Cortex XSOAR
Maltiverse	By: Cortex XSOAR
MaxMind GeoIP2	By: Cortex XSOAR
Microsoft Graph Mail	By: Cortex XSOAR
Threat Vault by Palo Alto Networks	By: Cortex XSOAR
PassiveTotal	By: RiskIQ
PolySwarm	By: PolySwarm
Pulsedive	By: Konrad Zacharias
Pwned	By: Cortex XSOAR
Recorded Future Intelligence	By: Recorded Future
RiskIQ Digital Footprint	By: RiskIQ
Shodan	By: Cortex XSOAR
Spamcop	By: Harri Ruuttila
Synapse	By: Jordan Berry
ThreatConnect	By: Cortex XSOAR
ThreatExchange	By: Cortex XSOAR
ThreatMiner	By: Cortex XSOAR
ThreatQ	By: Cortex XSOAR
TruSTAR (Deprecated)	By: TruSTAR
URLhaus	By: Cortex XSOAR
VirusTotal	By: VirusTotal
Whois	By: Cortex XSOAR
IBM X-Force Exchange	By: Cortex XSOAR
Zscaler Internet Access	By: Cortex XSOAR
Analyst1	By: Analyst1
Ipinfo	By: Cortex XSOAR
FireEye iSIGHT	By: Cortex XSOAR

All level dependencies (14)

Pack Name	Pack By
Common Playbooks	By: Cortex XSOAR
Brute Force	By: Cortex XSOAR
Base	By: Cortex XSOAR
NIST	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
SANS	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Sixgill Darkfeed - Annual Subscription	By: Cybersixgill
Cortex REST API	By: Cortex XSOAR
Microsoft Graph Security	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR

6.0.0 - 12587051 (September 1, 2026)

Incident Fields

New: Google SecOps Last Modified User ID
New: Added a new incident field - Google SecOps Last Modified User ID.
New: Google SecOps SLA Status
New: Added a new incident field - Google SecOps SLA Status.
New: Google SecOps SLA Expiration Time
New: Added a new incident field - Google SecOps SLA Expiration Time.
New: Google SecOps Source
New: Added a new incident field - Google SecOps Source.
New: Google SecOps Closure Comment
New: Added a new incident field - Google SecOps Closure Comment.
New: Google SecOps Update Time
New: Added a new incident field - Google SecOps Update Time.
New: Google SecOps Score
New: Added a new incident field - Google SecOps Score.
New: Google SecOps SLA Critical Expiration Time
New: Added a new incident field - Google SecOps SLA Critical Expiration Time.
New: Google SecOps Environment
New: Added a new incident field - Google SecOps Environment.
New: Google SecOps Description
New: Added a new incident field - Google SecOps Description.
New: Google SecOps Assignee
New: Added a new incident field - Google SecOps Assignee.
New: Google SecOps Products
New: Added a new incident field - Google SecOps Products.
New: Google SecOps Priority
New: Added a new incident field - Google SecOps Priority.
New: Google SecOps Status
New: Added a new incident field - Google SecOps Status.
New: Google SecOps Closure Root Cause
New: Added a new incident field - Google SecOps Closure Root Cause.
New: Google SecOps Important
New: Added a new incident field - Google SecOps Important.
New: Google SecOps Alerts SLA Status
New: Added a new incident field - Google SecOps Alerts SLA Status.
New: Google SecOps Alerts SLA Expiration Time
New: Added a new incident field - Google SecOps Alerts SLA Expiration Time.
New: Google SecOps Incident
New: Added a new incident field - Google SecOps Incident.
New: Google SecOps Last Modified User
New: Added a new incident field - Google SecOps Last Modified User.
New: Google SecOps Stage
New: Added a new incident field - Google SecOps Stage.
New: Google SecOps Case ID
New: Added a new incident field - Google SecOps Case ID.
New: Google SecOps Alerts SLA Critical Expiration Time
New: Added a new incident field - Google SecOps Alerts SLA Critical Expiration Time.
New: Google SecOps Involved Suspicious Entity
New: Added a new incident field - Google SecOps Involved Suspicious Entity.
New: Google SecOps Closure Action
New: Added a new incident field - Google SecOps Closure Action.
New: Google SecOps Type
New: Added a new incident field - Google SecOps Type.
New: Google SecOps SLA Remaining Time Since Last Pause
New: Added a new incident field - Google SecOps SLA Remaining Time Since Last Pause.
New: Google SecOps Playbook Status
New: Added a new incident field - Google SecOps Playbook Status.
New: Google SecOps Alert Count
New: Added a new incident field - Google SecOps Alert Count.
New: Google SecOps Alerts SLA Remaining Time Since Last Pause
New: Added a new incident field - Google SecOps Alerts SLA Remaining Time Since Last Pause.
New: Google SecOps Tasks
New: Added a new incident field - Google SecOps Tasks.
New: Google SecOps Closure Reason
New: Added a new incident field - Google SecOps Closure Reason.
New: Google SecOps Overflow Case
New: Added a new incident field - Google SecOps Overflow Case.
New: Google SecOps Alert Details
New: Added a new incident field - Google SecOps Alert Details.
New: Google SecOps Entity Details
New: Added a new incident field - Google SecOps Entity Details.

Incident Types

Chronicle Rule Detection
Updated the Chronicle Rule Detection incident type with the default IOC Enrichment and Blocking - Google SecOps playbook.
New: Google SecOps Case
New: Added a new incident type - Google SecOps Case.
Chronicle Curated Rule Detection
Updated the Chronicle Curated Rule Detection incident type with the default IOC Enrichment and Blocking - Google SecOps playbook.

Integrations

New: Google SecOps Cases

New: Added a new integration - Google SecOps Cases - that lets you retrieve Cases as Cortex XSOAR incidents. This integration also provides commands to manage the Cases lifecycle.
Added the following commands:
- gcb-case-list
- gcb-case-get
- gcb-case-update
- gcb-case-tag-add
- gcb-case-tag-remove
- gcb-case-priority-change
- gcb-case-stage-definition-list
- gcb-case-stage-change
- gcb-case-reopen
- gcb-case-close-definition-list
- gcb-case-close
- gcb-case-assign
- gcb-case-comment-list
- gcb-case-comment-create
- gcb-case-sla-pause
- gcb-case-sla-resume
- gcb-case-alert-list
- gcb-case-alert-get
- gcb-case-alert-update
- gcb-case-alert-tag-add
- gcb-case-alert-tag-remove
- gcb-case-alert-move
- gcb-case-alert-sla-pause
- gcb-case-alert-sla-resume
- gcb-case-alert-sla-set
- gcb-case-alert-recommendation-create
- gcb-case-alert-recommendation-fetch
- gcb-case-alert-customfield-list
- gcb-case-alert-entity-list
- gcb-case-alert-entity-get
- gcb-case-alert-entity-create
- gcb-case-alert-entity-update
- gcb-case-alert-entity-property-add
- gcb-case-alert-entity-property-update
- gcb-playbook-list
- gcb-playbook-attach

Google SecOps Streaming API

Added support for the Max Fetch parameter to set the maximum number of detections fetched in a single batch. Available options are 100, 75, 50, 25, and 10 (defaults to 100 if not selected).
Updated the integration help guide to improve the readability of the service account setup instructions.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.11185775.

Google SecOps v1 Alpha

Updated the integration help guide to improve the readability of the service account setup instructions.

Layouts

New: Google SecOps Case
New: Added a new layout - Google SecOps Case.

Mappers

New: Google SecOps Cases - Incoming Mapper

New: Added a new mapper - Google SecOps Cases - Incoming Mapper that maps incoming Google SecOps Case incident fields.

Playbooks

New: IOC Enrichment and Blocking - Google SecOps

This playbook enriches IOCs using the enrichment commands (IP, Email, Domain, URL, and File) and blocks the malicious IOCs based on DBot Score.

New: Case Investigation - Google SecOps

This playbook investigates a Google SecOps case by retrieving the latest case information, related alerts, and their entities, and updating the case stage. It also calculates severity from IOC scores, updates the incident and case priority accordingly, creates entities in the case from the identified IOCs, and posts a summary comment on the case.

Scripts

New: GoogleSecOpsSyncCaseInformation

New: Added a new script - GoogleSecOpsSyncCaseInformation - that syncs the latest case information, related alerts, and alert entities from Google SecOps and updates the Cortex XSOAR incident data.

Related pull requests:
- 45704
- 45221

Download

5.0.9 - 12411004 (August 27, 2026)

Integrations

Chronicle

Updated the Fetch Incidents configuration parameters.

Google SecOps v1 Alpha

Updated the Fetch Incidents configuration parameters.

Related pull requests:
- 45670

Download

5.0.8 - 12006327 (August 17, 2026)

Playbooks

Investigate On Bad Domain Matches - Chronicle

Set the Generate Investigation Summary Report task to skip gracefully when the script is unavailable on non-XSOAR marketplaces.

Related pull requests:
- 45504

Download

5.0.7 - 11856720 (August 12, 2026)

Scripts

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 45487

Download

5.0.6 - 10828903 (July 7, 2026)

Integrations

Chronicle

Updated the Docker image to: demisto/googleapi-python3:1.0.0.10182333.

Google SecOps Streaming API

Updated the Docker image to: demisto/googleapi-python3:1.0.0.10182333.

Google SecOps v1 Alpha

Updated the Docker image to: demisto/googleapi-python3:1.0.0.10182333.

Related pull requests:
- 44905

Download

5.0.5 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

5.0.4 - R7448282 (March 5, 2026)

Integrations

Google SecOps Streaming API

Added support for Default Severity of Incident parameter to select the default severity for incident when detection does not specify a severity. Available options are 'Critical', 'High', 'Medium', 'Low', 'Informational' and 'Unspecified' (If not selected, defaults to Unspecified).
Fixed an issue when the detection doesn't specify any severity.

Related pull requests:
- 42338
- 42389

Download

5.0.3 - 6180830 (December 7, 2025)

Integrations

Google SecOps Streaming API

Added support for API URL Format parameter to select the API URL format to use for API requests. Default value is '<chronicle>.<REGION>.<rep.googleapis.com>'. Only applicable if the "Use V1 Alpha API" parameter is selected.
Added support for Google SecOps Project Number parameter to provide the Project Number of the Google SecOps. Only applicable if the "Use V1 Alpha API" parameter is selected. Note: User can retrieve the Project Number in the Profile section of the Google SecOps page. If Project Number is not provided, then Project ID(from Service Account JSON) will be used.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.5476125.

Google SecOps v1 Alpha

Updated the fetch-incidents logic to handle a case where more than 10,000 IOCs present within one microsecond.
Added support for API URL Format parameter to select the API URL format to use for API requests. Default value is '<chronicle>.<REGION>.<rep.googleapis.com>'.
Added support for Google SecOps Project Number parameter to provide the Project Number of the Google SecOps. Note: User can retrieve the Project Number in the Profile section of the Google SecOps page. If Project Number is not provided, then Project ID(from Service Account JSON) will be used.
Added support for end_time argument in the gcb-list-iocs command.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.5476125.

Related pull requests:
- 41904
- 42184

Download

5.0.2 - 5994499 (November 24, 2025)

Documentation and metadata improvements.

Related pull requests:
- 42019

Download

5.0.1 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

5.0.0 - R5469292 (October 20, 2025)

Integrations

New: Google SecOps v1 Alpha

New: Added a new integration- Use "Google SecOps v1 Alpha" to retrieve IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Added the following commands:
- gcb-list-rules
- gcb-create-rule
- gcb-get-rule
- gcb-delete-rule
- gcb-create-rule-version
- gcb-change-rule-alerting-status
- gcb-change-live-rule-status
- gcb-verify-rule
- gcb-list-retrohunts
- gcb-get-retrohunt
- gcb-start-retrohunt
- gcb-cancel-retrohunt
- gcb-list-events
- gcb-get-event
- gcb-list-detections
- gcb-list-curatedrule-detections
- gcb-list-curatedrules
- gcb-test-rule-stream
- gcb-udm-search
- gcb-get-reference-list
- gcb-create-reference-list
- gcb-update-reference-list
- gcb-list-reference-list
- gcb-verify-reference-list
- gcb-verify-value-in-reference-list
- gcb-reference-list-append-content
- gcb-reference-list-remove-content
- gcb-list-iocs
- gcb-ioc-details
- ip
- domain
- gcb-list-data-tables
- gcb-create-data-table
- gcb-get-data-table
- gcb-verify-value-in-data-table
- gcb-data-table-add-row
- gcb-data-table-remove-row
- gcb-get-detection

Google SecOps Streaming API

Updated the integration to support Google SecOps v1 Alpha API.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.4892936.

Playbooks

Investigate On Bad Domain Matches - Chronicle

Updated the Investigate On Bad Domain Matches - Chronicle playbook to support Google SecOps v1 Alpha integration.

List Device Events - Chronicle

Updated the List Device Events - Chronicle playbook to support Google SecOps v1 Alpha integration.

Threat Hunting - Chronicle

Updated the Threat Hunting - Chronicle playbook to support Google SecOps v1 Alpha integration.

Related pull requests:
- 41176
- 41380

Download

4.1.8 - 4847835 (September 11, 2025)

Scripts

ListDeviceEvents

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41193

Download

4.1.7 - 4770511 (September 4, 2025)

Scripts

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

6.0.0 - 12587051 (September 1, 2026)

Incident Fields

New: Google SecOps Last Modified User ID
New: Added a new incident field - Google SecOps Last Modified User ID.
New: Google SecOps SLA Status
New: Added a new incident field - Google SecOps SLA Status.
New: Google SecOps SLA Expiration Time
New: Added a new incident field - Google SecOps SLA Expiration Time.
New: Google SecOps Source
New: Added a new incident field - Google SecOps Source.
New: Google SecOps Closure Comment
New: Added a new incident field - Google SecOps Closure Comment.
New: Google SecOps Update Time
New: Added a new incident field - Google SecOps Update Time.
New: Google SecOps Score
New: Added a new incident field - Google SecOps Score.
New: Google SecOps SLA Critical Expiration Time
New: Added a new incident field - Google SecOps SLA Critical Expiration Time.
New: Google SecOps Environment
New: Added a new incident field - Google SecOps Environment.
New: Google SecOps Description
New: Added a new incident field - Google SecOps Description.
New: Google SecOps Assignee
New: Added a new incident field - Google SecOps Assignee.
New: Google SecOps Products
New: Added a new incident field - Google SecOps Products.
New: Google SecOps Priority
New: Added a new incident field - Google SecOps Priority.
New: Google SecOps Status
New: Added a new incident field - Google SecOps Status.
New: Google SecOps Closure Root Cause
New: Added a new incident field - Google SecOps Closure Root Cause.
New: Google SecOps Important
New: Added a new incident field - Google SecOps Important.
New: Google SecOps Alerts SLA Status
New: Added a new incident field - Google SecOps Alerts SLA Status.
New: Google SecOps Alerts SLA Expiration Time
New: Added a new incident field - Google SecOps Alerts SLA Expiration Time.
New: Google SecOps Incident
New: Added a new incident field - Google SecOps Incident.
New: Google SecOps Last Modified User
New: Added a new incident field - Google SecOps Last Modified User.
New: Google SecOps Stage
New: Added a new incident field - Google SecOps Stage.
New: Google SecOps Case ID
New: Added a new incident field - Google SecOps Case ID.
New: Google SecOps Alerts SLA Critical Expiration Time
New: Added a new incident field - Google SecOps Alerts SLA Critical Expiration Time.
New: Google SecOps Involved Suspicious Entity
New: Added a new incident field - Google SecOps Involved Suspicious Entity.
New: Google SecOps Closure Action
New: Added a new incident field - Google SecOps Closure Action.
New: Google SecOps Type
New: Added a new incident field - Google SecOps Type.
New: Google SecOps SLA Remaining Time Since Last Pause
New: Added a new incident field - Google SecOps SLA Remaining Time Since Last Pause.
New: Google SecOps Playbook Status
New: Added a new incident field - Google SecOps Playbook Status.
New: Google SecOps Alert Count
New: Added a new incident field - Google SecOps Alert Count.
New: Google SecOps Alerts SLA Remaining Time Since Last Pause
New: Added a new incident field - Google SecOps Alerts SLA Remaining Time Since Last Pause.
New: Google SecOps Tasks
New: Added a new incident field - Google SecOps Tasks.
New: Google SecOps Closure Reason
New: Added a new incident field - Google SecOps Closure Reason.
New: Google SecOps Overflow Case
New: Added a new incident field - Google SecOps Overflow Case.
New: Google SecOps Alert Details
New: Added a new incident field - Google SecOps Alert Details.
New: Google SecOps Entity Details
New: Added a new incident field - Google SecOps Entity Details.

Incident Types

Chronicle Rule Detection
Updated the Chronicle Rule Detection incident type with the default IOC Enrichment and Blocking - Google SecOps playbook.
New: Google SecOps Case
New: Added a new incident type - Google SecOps Case.
Chronicle Curated Rule Detection
Updated the Chronicle Curated Rule Detection incident type with the default IOC Enrichment and Blocking - Google SecOps playbook.

Integrations

New: Google SecOps Cases

New: Added a new integration - Google SecOps Cases - that lets you retrieve Cases as Cortex XSOAR incidents. This integration also provides commands to manage the Cases lifecycle.
Added the following commands:
- gcb-case-list
- gcb-case-get
- gcb-case-update
- gcb-case-tag-add
- gcb-case-tag-remove
- gcb-case-priority-change
- gcb-case-stage-definition-list
- gcb-case-stage-change
- gcb-case-reopen
- gcb-case-close-definition-list
- gcb-case-close
- gcb-case-assign
- gcb-case-comment-list
- gcb-case-comment-create
- gcb-case-sla-pause
- gcb-case-sla-resume
- gcb-case-alert-list
- gcb-case-alert-get
- gcb-case-alert-update
- gcb-case-alert-tag-add
- gcb-case-alert-tag-remove
- gcb-case-alert-move
- gcb-case-alert-sla-pause
- gcb-case-alert-sla-resume
- gcb-case-alert-sla-set
- gcb-case-alert-recommendation-create
- gcb-case-alert-recommendation-fetch
- gcb-case-alert-customfield-list
- gcb-case-alert-entity-list
- gcb-case-alert-entity-get
- gcb-case-alert-entity-create
- gcb-case-alert-entity-update
- gcb-case-alert-entity-property-add
- gcb-case-alert-entity-property-update
- gcb-playbook-list
- gcb-playbook-attach

Google SecOps Streaming API

Added support for the Max Fetch parameter to set the maximum number of detections fetched in a single batch. Available options are 100, 75, 50, 25, and 10 (defaults to 100 if not selected).
Updated the integration help guide to improve the readability of the service account setup instructions.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.11185775.

Google SecOps v1 Alpha

Updated the integration help guide to improve the readability of the service account setup instructions.

Mappers

New: Google SecOps Cases - Incoming Mapper

New: Added a new mapper - Google SecOps Cases - Incoming Mapper that maps incoming Google SecOps Case incident fields.

Playbooks

New: IOC Enrichment and Blocking - Google SecOps

This playbook enriches IOCs using the enrichment commands (IP, Email, Domain, URL, and File) and blocks the malicious IOCs based on DBot Score.

New: Case Investigation - Google SecOps

Scripts

New: GoogleSecOpsSyncCaseInformation

New: Added a new script - GoogleSecOpsSyncCaseInformation - that syncs the latest case information, related alerts, and alert entities from Google SecOps and updates the Cortex XSOAR incident data.

Related pull requests:
- 45704
- 45221

Download

5.0.9 - 12411004 (August 27, 2026)

Integrations

Chronicle

Updated the Fetch Incidents configuration parameters.

Google SecOps v1 Alpha

Updated the Fetch Incidents configuration parameters.

Related pull requests:
- 45670

Download

5.0.8 - 12006327 (August 17, 2026)

Playbooks

Investigate On Bad Domain Matches - Chronicle

Set the Generate Investigation Summary Report task to skip gracefully when the script is unavailable on non-XSOAR marketplaces.

Related pull requests:
- 45504

Download

5.0.7 - 11856720 (August 12, 2026)

Scripts

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 45487

Download

5.0.6 - 10828903 (July 7, 2026)

Integrations

Chronicle

Updated the Docker image to: demisto/googleapi-python3:1.0.0.10182333.

Google SecOps Streaming API

Updated the Docker image to: demisto/googleapi-python3:1.0.0.10182333.

Google SecOps v1 Alpha

Updated the Docker image to: demisto/googleapi-python3:1.0.0.10182333.

Related pull requests:
- 44905

Download

5.0.5 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

5.0.4 - R7448282 (March 5, 2026)

Integrations

Google SecOps Streaming API

Added support for Default Severity of Incident parameter to select the default severity for incident when detection does not specify a severity. Available options are 'Critical', 'High', 'Medium', 'Low', 'Informational' and 'Unspecified' (If not selected, defaults to Unspecified).
Fixed an issue when the detection doesn't specify any severity.

Related pull requests:
- 42338
- 42389

Download

5.0.3 - 6180830 (December 7, 2025)

Integrations

Google SecOps Streaming API

Added support for API URL Format parameter to select the API URL format to use for API requests. Default value is '<chronicle>.<REGION>.<rep.googleapis.com>'. Only applicable if the "Use V1 Alpha API" parameter is selected.
Added support for Google SecOps Project Number parameter to provide the Project Number of the Google SecOps. Only applicable if the "Use V1 Alpha API" parameter is selected. Note: User can retrieve the Project Number in the Profile section of the Google SecOps page. If Project Number is not provided, then Project ID(from Service Account JSON) will be used.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.5476125.

Google SecOps v1 Alpha

Updated the fetch-incidents logic to handle a case where more than 10,000 IOCs present within one microsecond.
Added support for API URL Format parameter to select the API URL format to use for API requests. Default value is '<chronicle>.<REGION>.<rep.googleapis.com>'.
Added support for Google SecOps Project Number parameter to provide the Project Number of the Google SecOps. Note: User can retrieve the Project Number in the Profile section of the Google SecOps page. If Project Number is not provided, then Project ID(from Service Account JSON) will be used.
Added support for end_time argument in the gcb-list-iocs command.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.5476125.

Related pull requests:
- 41904
- 42184

Download

5.0.2 - 5994499 (November 24, 2025)

Google SecOps

Documentation and metadata improvements.

Related pull requests:
- 42019

Download

5.0.1 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

5.0.0 - R5469292 (October 20, 2025)

Integrations

New: Google SecOps v1 Alpha

New: Added a new integration- Use "Google SecOps v1 Alpha" to retrieve IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Added the following commands:
- gcb-list-rules
- gcb-create-rule
- gcb-get-rule
- gcb-delete-rule
- gcb-create-rule-version
- gcb-change-rule-alerting-status
- gcb-change-live-rule-status
- gcb-verify-rule
- gcb-list-retrohunts
- gcb-get-retrohunt
- gcb-start-retrohunt
- gcb-cancel-retrohunt
- gcb-list-events
- gcb-get-event
- gcb-list-detections
- gcb-list-curatedrule-detections
- gcb-list-curatedrules
- gcb-test-rule-stream
- gcb-udm-search
- gcb-get-reference-list
- gcb-create-reference-list
- gcb-update-reference-list
- gcb-list-reference-list
- gcb-verify-reference-list
- gcb-verify-value-in-reference-list
- gcb-reference-list-append-content
- gcb-reference-list-remove-content
- gcb-list-iocs
- gcb-ioc-details
- ip
- domain
- gcb-list-data-tables
- gcb-create-data-table
- gcb-get-data-table
- gcb-verify-value-in-data-table
- gcb-data-table-add-row
- gcb-data-table-remove-row
- gcb-get-detection

Google SecOps Streaming API

Updated the integration to support Google SecOps v1 Alpha API.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.4892936.

Playbooks

Investigate On Bad Domain Matches - Chronicle

Updated the Investigate On Bad Domain Matches - Chronicle playbook to support Google SecOps v1 Alpha integration.

List Device Events - Chronicle

Updated the List Device Events - Chronicle playbook to support Google SecOps v1 Alpha integration.

Threat Hunting - Chronicle

Updated the Threat Hunting - Chronicle playbook to support Google SecOps v1 Alpha integration.

Related pull requests:
- 41176
- 41380

Download

4.1.8 - 4847835 (September 11, 2025)

Scripts

ListDeviceEvents

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41193

Download

4.1.7 - 4761438 (September 4, 2025)

Scripts

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	April 14, 2020
Last Release	September 1, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

Zscaler Internet Access via ZIdentity (Beta)

Palo Alto Networks Threat Vault (Deprecated)

Palo Alto Networks AutoFocus v2 (Deprecated)

Cybersixgill DVE Feed Threat Intelligence (Deprecated)

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.