How to Create a Separate Environment in Google SecOps (Chronicle)

One of the questions I get asked quite often is whether it’s possible to separate alerts and cases for different teams, departments, or subsidiaries while using a single Google SecOps tenant.

The answer is yes.

Google SecOps provides Environments, which allow you to logically separate investigations, alerts, and cases without the overhead of managing multiple tenants. This can be especially useful for large organizations, MSSPs, or companies that want different teams to work independently while still using the same SecOps instance.

In this article, I’ll walk through the process of creating a new environment and configuring alert routing so that alerts automatically land in the correct environment.

Why Use Environments?

Let’s say your organization has multiple business units, such as Finance, IT Operations, and Corporate Security. Or maybe you’re an MSSP supporting multiple customers from a single SecOps deployment.

Instead of having everyone work from the same alert queue, you can create dedicated environments and route alerts accordingly. This makes investigations cleaner and helps ensure analysts only see the cases relevant to their responsibilities.

Step 1: Create a New Environment

The first step is straightforward.

Navigate to:

SOAR Settings → Environments

From there, create a new environment. For example:

• Production
• Finance
• Customer-A
• Customer-B

Choose a name that clearly represents the team, customer, or business unit that will use it.

This name becomes important later, so it’s worth deciding on a consistent naming convention from the beginning.

Step 2: Create a Google Chronicle Alerts Connector

Once the environment exists, you’ll need a way to bring alerts into it.

Navigate to:

SOAR Settings → Ingestion → Connectors

Create a new connector and select:

Google Chronicle Alerts

This connector is responsible for retrieving detections from Google SecOps and creating alerts and cases within SOAR.

The Most Important Setting

When configuring the connector, make sure you select the correct Environment.

This might sound obvious, but it’s one of the most common mistakes during setup. If the wrong environment is selected, alerts will be created in the wrong location, making routing and case management confusing for analysts.

Step 3: Authentication for BYOP Deployments

If your organization uses a Bring Your Own Project (BYOP) deployment, there are a few additional steps.

You’ll need to create a Service Account within Google Cloud.

Go to your Google Cloud project and:

1. Create a new Service Account.
2. Grant the Chronicle API Editor role.
3. Generate a JSON key.
4. Download the key file.

When configuring the Chronicle Alerts connector, you’ll need to provide the credentials from that JSON file. Simply copy the required values from the Service Account key and populate the credential fields in the connector configuration.

Without the proper permissions, the connector won’t be able to communicate with Chronicle APIs.

Step 4: Finding the API Root

Another area that often causes confusion is the API Root value.

In the past, many people relied on Backstory API endpoints, but those endpoints are no longer the recommended approach.

A quick way to find the correct API Root is:

1. Open Google SecOps.
2. Right-click anywhere on the page and select Inspect.
3. Open the Network tab.
4. Navigate to Data Tables within the SecOps interface.
5. Look for a request similar to:

dataTables?pageSize=1000

Open that request and inspect its URL.

You’ll see something like:

https://your-secops-instance/.../dataTables?pageSize=1000

Everything before /dataTables is your API Root.

That’s the value you’ll need when configuring the connector.

Step 5: Route Alerts to the Correct Environment

Now comes the part that makes environments truly useful.

To ensure alerts are created in the right environment, you can use Regex Filters within your connector configuration.

These filters allow you to route alerts based on specific criteria, such as:

• Customer identifiers
• Log source names
• Hostnames
• Asset groups
• Detection metadata

For example, alerts related to Finance systems can be sent to the Finance environment, while alerts related to Production assets can be routed to the Production environment.

Once configured correctly, analysts will only see the alerts and cases that belong to their designated environment.

Step 6: Don’t Forget the Namespace

This is probably the most overlooked step in the entire process.

When ingesting logs into Google SecOps, the Namespace value must match the environment name exactly.

For example:

Environment:

Production

Namespace:

Production

Or:

Environment:

Customer-A

Namespace:

Customer-A

The values should be identical.

If they don’t match, alert routing may not work as expected, and troubleshooting can become unnecessarily complicated.

Final Thoughts

Google SecOps Environments are a simple but powerful feature for organizations that need operational separation without the complexity of multiple tenants.

The overall process is straightforward:

• Create an environment
• Configure a Google Chronicle Alerts connector
• Set up authentication
• Identify the correct API Root
• Use regex filters for routing
• Ensure namespaces match environment names

Once everything is in place, you’ll have a much cleaner and more scalable way to manage alerts and cases across different teams, departments, or customers.

If you’re running a shared Google SecOps deployment and looking for a practical way to separate operations, environments are definitely worth considering.