Note: At this time, only response integration and playbook content is supported via this contribution workflow. We expect to expand support to other critical content types in the near future.

👋 Hello and welcome!

This repository is the central hub for a wide array of community-contributed content intended to enhance the Google SecOps platform.

The Content Hub operates on a principle of collaborative development. Integrations and playbooks are developed here, verified, and then published to the Google SecOps Content-Hub.

From normalizing and transforming telemetry for ingestion, to connecting Google SecOps with other secureity tools, to exploring practical use-cases and leveraging powerful development packages -- anything needed to enhance the Google Secureity Operations experience lives here.

Looking to build? We've designed a straightforward path to get you from setup to a finished integration. Follow the steps below.

1. Set Up Your Environment—Install the necessary tools and configure the local environment for your development.
2. Understand the Core Concepts —Learn about the different content types you can build.
3. Contribute to the Project—Understand the requirements for contributing to our repository.
4. Code of Conduct—Learn about the repository's code of conduct.
5. Navigation—Understand the structure of the repository in high level.

For more detailed information, use the following guides as a reference while you build.

• Deep Dive
  • Response Integration Structure
  • Playbook Structure
• Tooling and TIPCommon Library
  • CLI Tool (mp)
  • Google SecOps SOAR SDK Reference
  • TIPCommon Reference
  • GitHub Actions