Environment Setup in Chronicle SOAR

[vanitharaj1208]

1. Alias

•  What is Alias ? 
• How to leverage this alias , while setting up new environments ?
• can any one provide an example ?

Link :https://cloud.google.com/chronicle/docs/soar/admin-tasks/environments/add-a-new-environment 

"Make sure to add in an alias if the third party integration has a different tenant name defined."

[KyHud]

Hey,

An example of an Alias we use, say for example you have an EDR product which references Company name "LimitedCompany LTD", but you want to name your Environment "LimitedCompany", setting the Alias as "LimitedCompany LTD" allows you to refer to this in playbooks with the [Environment.Alias] placeholder for the specific EDR product steps.

This is also handy if you want to have environments as seperate networks (therefore have different resolver groups), but they all come under the company name in things like ITSM toolsets. You can have each environment named as the network, but have the Alias as the Company name. 

Think of it as a secondary label for your environment, which you can also use within playbooks, but not necessarily have it as the name of the environment.

Cheers

K

[SoarAndy · Accepted solution]

We have orgs/MSSP that run some Connectors which ingest Alerts on behalf of different customers. two examples:

- a mailbox that multiple customers forward emails to (e.g. phishing@mssp), this is Exchange connector

- a connector to an old shared SIEM that is not multi tenant (no customer access allowed), but a MSSP is routing inbound SIEM-SOAR alerts into the MultiTenancy

In these cases the Connector has 'Environment field name', which allows the Connector to analyse a Key of the inbound alert, and the associated Value is compared to the Alias field you point to above. 

It's a feature for specific use cases, and is not used by the majority of customers.

HTH

Andy