Comprehensive and Detailed Explanation
The correct solution is Option C. Google SecOps SOAR has a specific feature designed for this exact use case: Advanced Reports.
The standard "SOAR Reports" (Option A) are pre-canned dashboard-style reports (e.g., Management - SOC Status). However, the "Advanced Reports" feature (built on Looker) provides a powerful, flexible interface for building highly customized, tabular reports based on case data. This allows an administrator to specifically query for case resolutions and SLA metrics, and filter them by priority = High OR Critical.
Most importantly, the Advanced Reports feature has a built-in scheduler. This scheduler can be configured to run the report at a specific cadence (e.g., "Weekly on Monday at 9:00 AM"), send it to a list of email recipients, and attach the data in the required format, including CSV and as a zipped file.
Option B is incorrect because detection rules create alerts, they don't report on case metrics. Option D is incorrect because it mixes the SIEM search function with a SOAR job, which is an overly complex and unnecessary way to query case data that is already structured within the SOAR module.
Exact Extract from Google Security Operations Documents:
Explore advanced SOAR reports: The default advanced SOAR reports are a set of dashboards and reports to help track SOC performance, case handling, analyst workload, and automation efficiency. These reports provide both high-level and detailed insights across your environments.1
SLA Monitoring: Use Triage Time and SLA Met flag to monitor SLA compliance and improve case handling.
Manage advanced reports: You can create, edit, duplicate, share, download, and delete advanced reports.
Schedule a report:
Select the report you want to schedule.
Select the Scheduler tab and click Add.
In the New Schedule dialog, click the Enable toggle to turn on scheduling and enter the required information (e.g., weekly, Monday, email recipients).
You can select the delivery format, including CSV and ZIP attachments.
[References:, Google Cloud Documentation: Google Security Operations > Documentation > Monitor and report > SOAR reports > Use Looker Explores in SOAR reports (Advanced Reports), Google Cloud Documentation: Google Security Operations > Documentation > Monitor and report > SOAR reports > Explore SOAR reports, , ]
