Hi everyone,

We’re currently implementing SecOps and I’m struggling with a specific scenario where I couldn’t find clear documentation. At the moment, we have a single environment that centralizes all open cases. Our requirement is to segment these alerts so that, for example, firewall events are separated by client, in different environments, based on criteria such as IP addresses, domain names, or even email addresses.

My questions are:

• What would be the best way to automatically assign these cases to the right environment?

• Should this be handled with rules, or is it better to use playbooks for this type of segmentation?

If anyone has faced a similar situation or can share best practices, I’d really appreciate your input.