Overview
RansomLeak is a Google Security Operations (Google SecOps) Build Partner. Our response integration for Google SecOps puts each user's human risk score and training record next to the alert, and lets a playbook end with training for the person involved.
- Enrich users with risk and training status
- Assign a learning path or one exercise
- Check training status from the case
- Idempotent, so a rerun never assigns twice
Availability
The RansomLeak integration for Google SecOps is coming to the Google SecOps Content Hub. Until it is listed there, it is available on request: email support@ransomleak.com with your Google SecOps instance region and your RansomLeak tenant address.
Requirements
- A Google SecOps instance with SOAR, and permission to install and configure integrations.
- A RansomLeak tenant, and an admin there with the Manage Integrations permission.
- Users exist in RansomLeak under the same email address that appears on User entities in your cases.
Set up
-
In RansomLeak, go to Integrations → API and generate an API token with the Integration API scope. Copy it.
-
In Google SecOps, open Marketplace, find RansomLeak, and select Configure.
-
Set API Root to your tenant address, for example
https://acme.ransomleak.com(orhttps://acme.eu.ransomleak.comfor an EU-hosted tenant). Paste the token as API Key and leave Verify SSL on. -
Save, then run the Ping action to test the connection.
Actions
| Action | What it does |
|---|---|
| Ping | Tests the connection with the configured API Root and API Key. |
| Enrich Users | Adds the human risk score, risk level and training status (completed, in progress, overdue, average quiz score) to User entities, matched by email. Can also create an insight per user. |
| Assign Training | Enrolls users in a learning path, or assigns a single exercise that emails the user a direct link. |
| Get Training Status | Returns training progress for users, or the status of assignments made by Assign Training. |
| List Learning Paths | Lists published learning paths and their IDs, to pick one for Assign Training. |
Permissions and data handling
The integration sends RansomLeak only the email addresses of the users in scope and the learning path or exercise to assign. It reads back training and risk data for those users. All calls go over TLS to your own tenant, and the API token is stored in Google SecOps. Revoke the token in RansomLeak at any time to cut access.
For how RansomLeak handles data, see the privacy policy and the security and compliance page.
Support
RansomLeak supports this integration. For access, help connecting, or a problem, email support@ransomleak.com with your RansomLeak tenant address.
Frequently asked questions
Is RansomLeak a Google SecOps partner?
Yes. RansomLeak is a Google Security Operations (Google SecOps) Build Partner in the Google Cloud Partner Network, and builds and maintains this integration with access to a Google SecOps developer instance.
Is the integration in the Google SecOps Content Hub?
Not yet. It has been submitted and is coming to the Content Hub. Until it is listed there, it is available on request from support@ransomleak.com, and the setup is the same once it is listed.
What can a playbook do with it?
Enrich User entities in a case with their human risk score and training status, assign a learning path or a single exercise to the people involved, check the status of that training later, and list the learning paths you can assign.
What credentials does it need?
A RansomLeak API token with the Integration API scope, created by a RansomLeak admin under Integrations, API. It is stored in Google SecOps as the API Key parameter. No Google credentials are shared with RansomLeak.
Does it work with EU-hosted RansomLeak tenants?
Yes. Set API Root to your EU tenant address, for example https://acme.eu.ransomleak.com, and calls go to the EU stack only.
Need a hand?
Email support@ransomleak.com and we will help you connect Google SecOps to your tenant.