Google Chronicle SOAR

Connect Google Chronicle SOAR to collect security automation evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Google Chronicle SOAR:

   1. In the Google Cloud console project bound to your Google SecOps instance, open the Service accounts page and select the project.
   2. Pick the service account Safeguard will use.
   3. Click the service account's email address, then click the Keys tab.
   4. Click the Add key drop-down menu and select Create new key.
   5. Select JSON as the key type and click Create. The JSON file downloads once; paste its contents into Safeguard.

   Where to find the other values:

   • Project ID: The Google Cloud project you selected on the Service accounts page (the project linked to Google SecOps).
   • Instance ID: Your Google SecOps customer ID: in SOAR, SOAR Settings › Organization › License Management.

   Google Chronicle SOAR shows the secret only once, so copy it before you leave the page.

   Google Chronicle SOAR's public documentation does not cover every step.

   Key creation is blocked if the org policy iam.disableServiceAccountKeyCreation is enforced (default for organizations created after May 3, 2024); an admin must exempt the project. The IAM role-grant click path and the Location value were not on fetched pages. The SIEM Profile location came from an official search snippet; the SOAR location was fetched. Google says the legacy SOAR API keys stop working on November 30, 2026. Verification: the Chronicle roles page redirected to an API reference index with no role definitions, so the Chronicle API Viewer (roles/chronicle.viewer) grant, the SIEM Profile location and the legacy SOAR API key date could not be confirmed and the role step was removed from the click path.

   Source: docs.cloud.google.com, docs.cloud.google.com, cloud.google.com, checked 2026-10-07.

   The permissions Safeguard needs: roles/chronicle.viewer.

2. On Compliance › Connectors, open Google Chronicle SOAR, click Connect, choose API token and fill in:

   Field	What to enter
   Project ID	Optional.
   Location	Optional. For example: us
   Instance ID	Optional.
   Service account key (JSON)	Optional. Stored encrypted and never shown again.

   Or, instead: Access token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Google Chronicle SOAR and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Security Automation connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks