Using the Marketplace
You can enter the marketplace by clicking on the Marketplace icon on the top right of the screen.
The Chronicle SOAR Marketplace acts as the customer’s toolbox, holding a wide range of utilities and options to choose from, including:
Integrations: includes integrations to third party applications and custom integrations that you have built in the IDE. In all cases you need to install them in this screen and then for those that need advanced configuration, you need to configure them in the Integrations screen via the Gear icon.
Use Cases: These are pre-built playbook workflows to integrate into the organizational security products for automated IR process and to optimize your Chronicle SOAR installation. They include predefined use cases from Chronicle SOAR and customer uploaded use cases to either test drive Chronicle SOAR functionality or incorporate into your own use cases.
Power Ups: including tools created by Chronicle SOAR Professional Services that enhance customers’ ability to automate processes for more efficient Playbooks.
Analytics: this tab allows you to download Advanced Reports to use within the Reports > Advanced Reports screen. For more information on this, refer to here and here.
Integrations
Clicking on Integrations displays the following screen.
There are three types of integrations you can see in the Marketplace:
- Commercial – integrations to third party applications which have been developed by Chronicle SOAR – including new and updated ones
- Community – integrations published by users (which have been validated by Chronicle SOAR and which will appear with user details next to them)
- Custom – integrations which you have created and which are only displayed on your Marketplace
Filtering Integrations
You can display the Integrations according to integration type (for example, show custom integrations, published by users) or by status (for example, installed, available update).
Integrations that have not been installed yet will have a downwards arrow on the bottom right of the box.
Click on this to successfully install the integration. For detailed information on installing and configuring an Integration, see here.
Note that for each supported Integration in the Marketplace, there is a link to an Integrations and Connectors Portal page with detailed information on that specific Integration.
Use Cases
Use Cases enhance your ability to shorten the time to value and to see how Chronicle SOAR experts or community users are tackling a specific attack or any other SOC challenge.
Each Use Case contains relevant items such as integrations, Playbooks etc. in order to simulate an entire workflow from end-to-end. After deploying one of these use cases, you can choose to Simulate it in the Cases tab. In addition, you can configure the Connector, and/or edit the Playbook, of a predefined Use Cases and run it on real data.
The following actions can be carried out from this screen:
Create New Use Case: You can create your own Use Case with playbook/s, test case/s and connector/s. Click Save to save locally it in your Marketplace only. You can also export it.
Publish Use Case: Click on this option to have your Use Case published for all users. Once it’s uploaded, it’s sent to a dedicated Chronicle SOAR team who will analyze it and add it to the Use Case repository for all customers and community members to use. The goal of this option is to encourage all our customers to share playbooks and use cases that can help others out with their Chronicle SOAR journey. You can alter your photo and user details here before sending it. These identifiers will be published for all users.
Import Use Case: Useful for importing from other platforms such as Staging.
Power Ups
These Chronicle SOAR tools enable users to enhance their Playbooks with various actions. The power ups do not need any special configuration as they are in-house Chronicle SOAR actions. New power ups will be pushed to the Marketplace all the time. Click on the Read More in each power up to see what they contain.
Analytics (Tableau users only)
For customers with a dedicated license, you can download Advanced Reports here and view them in the Reports tab. For full information, please see here.
Updating the Marketplace Version
Online Customers
All new integrations and use cases will be automatically pushed to the Chronicle SOAR platform. Note that the platform requires communication in order to work with the online marketplace.
Offline Customers
For customers who are not online, they need to deselect the Use Online Marketplace navigate to Settings > Advanced > General screen.
Once this is deselected, the option to import the latest Marketplace version will appear in the Marketplace screen. Speak to your Customer Success rep in order to get access to zip file updates.