Work with your environments

Environments represent distinct networks, customers, or business units managed by your SOC or Managed Security Service Provider (MSSP). They help segment data, actions, and visibility across different operational contexts. This document explains how to work with your environments to make it easier to manage security operations for multiple tenants or organizational divisions from a single platform.

Add a new environment

When you add a new environment, it lets your SOC or MSSP manage and monitor distinct networks, customers, or business units within the platform. This setup helps isolate data and workflows across different environments while maintaining centralized visibility and control.

The platform provides a predefined environment named Default Environment by default.

Use the following steps to configure and register a new environment in Google Security Operations

1. Go to Settings > Organization > Environments.
2. Click add Add.
3. In the Add Environment dialog, enter the required information.
4. Optional: Select the Append to all Users and API Keys checkbox to automatically assign the new environment to all existing users and API keys. You can also add an alias if a third-party integration uses a different tenant name.
5. If the Allow Data Retention Period per Environment checkbox is not selected in Settings > Advanced > General, specify the time period for deleting information related to closed cases in this environment.
6. Click Create. The new environment appears in the list of environments.

Allow access to other environments

Google Security Operations offers you a way to create a customized Cross Environment Policy that works for your organization's needs. Use the Cross Environment Policy settings to choose the required permissions for assigning users to cases and moving cases between environments.

Assign cases in environments

With the Assign Case option, you can let users have access to a specific cases in environments where they don't have default permissions. This option is useful when you need to investigate or collaborate on cases outside your assigned environment. With this permission enabled, you can also assign manual actions, create case tasks, and add mentions in the case wall or chat. As a best practice, we recommend keeping the Assign Case setting at Prevent (default).

Move cases between environments

Under Move Case option, you can control whether users are granted permission to move cases between environments. This is helpful when you investigate alerts in the context of a different environment within the organization.

Assign cases across environments

To assign a case, follow these steps:

1. Go to Settings > Advanced > General.
2. In the Cross Environment Policy dialog, under Assign Case, select Allow users to assign cases to users from other environments.
   
3. Click Save.

Move cases to a different environment

To move cases to a different environment, follow these steps:

1. Click Settings > Advanced > General.
2. In the Cross Environment Policy dialog, under Move Case, select Allow users to move cases between environments.
   
3. Click Save.
   

Delete an environment

To delete an environment, follow these steps:

1. Go to Settings > Organization > Environments.
2. Select the required environment, and then click editEdit.
3. In the Edit Environment dialog, click deleteDelete. The Delete page lists all configurations and utilities associated with this environment. Once you delete this environment, you can't undo this action.
4. Click Confirm.