# Google SecOps SOAR integration (QUX)

This integration implements the investigative and generic actions, connector and job for the Vectra QUX app on the Chronicle SOAR Platform. It will allow end-users to implement any use cases on the Vectra Cloud Platform that are possible using a combination of the below-mentioned actions.

**Actions:**

* Test Connectivity(ping): Tests the connectivity of the Chronicle SOAR server to Vectra.
* Search Hosts: List hosts based on query parameters.
* Search Accounts: List accounts based on query parameters.
* Search Detections: List detections based on query parameters.
* Mark Entity Fixed: Mark the given detections as fixed.
* Mark Detection Fixed: Mark detections as fixed for provided IDs
* Unmark Detection Fixed: Unmark the given detections as fixed.
* Describe Entity: Show all the details of an entity for the given ID.
* Describe Detection: Show all the details of a detection for the given ID.
* Add Tags: Add tags to the given entity IDs
* Remove Tags: Remove tags from the given entity ID.
* Add Note: Add a note to the given entity ID
* Remove Note: Remove a note from the given entity ID.
* List Entity Detections: List all the detections for the given entity ID
* Assign Entity: Assign an entity to the given user ID.
* Update Assignment: Updates the assigned user in the assignment for the given entity.
* Remove Assignment: Remove the assignment for the given entity ID.
* Download PCAP: Download the PCAP file for the given detection ID.
* List Assignments: List all the assignments based on the query see parameters.
* Describe Assignment: Show all the details of an assignment for the given ID.
* Resolve Assignment: Resolve assignment based on the given assignment ID and outcome ID.
* List Outcomes : List all the assignment outcomes.
* Add Outcome : Add outcome with title and category.
* List Users: List users based on the query parameters.
* List Groups: List groups based on the query parameters.
* Assign Group: Add members to the given group ID.
* Remove Group: Remove members from the given group ID.

**Connector**

* Vectra QUX - Entities Connector: Pull entities and their detections from the Vectra QUX platform and create a case in Chronicle SOAR.

**Job**

* Vectra QUX - Clear Empty Cases Job: Close the Chronicle case if the detection is attached to a different entity or no detections remain.

**Playbooks**

* Vectra QUX – Process Case Playbook: Assigns a Vectra user to the entity in Vectra and adds a note to link to the Google SecOps Case.
* Vectra QUX – Resolve Case Playbook: Resolves the entity in Vectra with reasoning and closes the case in Google SecOps.

### Attachments

{% file src="<https://4227135129-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHJ1ltuWFvsArFWtevnRn%2Fuploads%2Fgit-blob-a294bed491c86b428fd7289b5895f65fcc972ae5%2FVectra_QUX_Integration_Guide_Google_SecOps_SOAR.pdf?alt=media>" %}