+141. Alias
Link :https://cloud.google.com/chronicle/docs/soar/admin-tasks/environments/add-a-new-environment
"Make sure to add in an alias if the third party integration has a different tenant name defined."
Best answer by SoarAndy
We have orgs/MSSP that run some Connectors which ingest Alerts on behalf of different customers. two examples:
- a mailbox that multiple customers forward emails to (e.g. phishing@mssp), this is Exchange connector
- a connector to an old shared SIEM that is not multi tenant (no customer access allowed), but a MSSP is routing inbound SIEM-SOAR alerts into the MultiTenancy
In these cases the Connector has 'Environment field name', which allows the Connector to analyse a Key of the inbound alert, and the associated Value is compared to the Alias field you point to above.
It's a feature for specific use cases, and is not used by the majority of customers.
HTH
Andy
+5Hey,
An example of an Alias we use, say for example you have an EDR product which references Company name "LimitedCompany LTD", but you want to name your Environment "LimitedCompany", setting the Alias as "LimitedCompany LTD" allows you to refer to this in playbooks with the [Environment.Alias] placeholder for the specific EDR product steps.
This is also handy if you want to have environments as seperate networks (therefore have different resolver groups), but they all come under the company name in things like ITSM toolsets. You can have each environment named as the network, but have the Alias as the Company name.
Think of it as a secondary label for your environment, which you can also use within playbooks, but not necessarily have it as the name of the environment.
Cheers
K
+12We have orgs/MSSP that run some Connectors which ingest Alerts on behalf of different customers. two examples:
- a mailbox that multiple customers forward emails to (e.g. phishing@mssp), this is Exchange connector
- a connector to an old shared SIEM that is not multi tenant (no customer access allowed), but a MSSP is routing inbound SIEM-SOAR alerts into the MultiTenancy
In these cases the Connector has 'Environment field name', which allows the Connector to analyse a Key of the inbound alert, and the associated Value is compared to the Alias field you point to above.
It's a feature for specific use cases, and is not used by the majority of customers.
HTH
Andy
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
