Google Secops Environments

in the SOAR connector setting, the value in ‘Environment Field Name’ must be flatten.

The connector applies some flattening method on the retrieved alert events with json structure, using the underscore (_) as delimiter.


Let’s say in the rule meta section we’ve defined a soar_environment field.
The retrieved alert would have something like this:
{"detection":{"ruleLabels":{"soar_environment": "test"}}}

In the SOAR connector setting ‘Environment Field Name’ we should use the flatten value detection_ruleLabels_soar_environment

If the connector doesn’t get any value, it reverts back to ‘Default Environment’

Detection fields for reference.

Thank you!
It’s working with custom detection rules, after I add it in my meta section. 
How can I work with different environments with curated detection rules?
Thanks

I'm not using curated detections yet. Assuming we cannot edit them by adding an environment field, I guess as customers we have these options:

- use the Default Environment for curated detections
- clone the curated detection as custom, and add the environment field there
- request Google Product team to add the feature of an environment field in the curated detections
- maybe there is some hack by playing with 'Environment Field Name' and 'Environment Regex Pattern', but I cannot think of any on top of my head