Create environment groups

Supported in:

In addition to creating environments, you can also create groups of environments. This feature lets you group environments into logical categories, making it easier to manage your company or customers as a Managed Security Service Provider (MSSP).

Using environment groups to support use cases

MSSPs, government entities and enterprises with multiple sub-organizations can all benefit from using environment groups. These use cases include:

  • MSSP service-level groups: differentiating service based on customer tiers (for example, Gold, Silver).
  • Government sectors: customizing security solutions for specific industries (for example, communication, transportation).
  • Enterprise sub-organizations: managing security for individual sub-organizations within a larger entity (for example, Sub Org 1, Sub Org 2).

Supported modules for environment groups

Environment groups are supported in the following modules:

  • Settings: Creating environment groups speeds up user onboarding of new users and simplifies adding new environments to existing groups.
  • Playbooks or blocks: Environment groups streamline the creation of playbooks, letting you adjust the scope of your playbooks by grouping environments together. Playbooks automatically update the scope when the environment groups are modified.
  • Case filters: Environment groups can also be used within case filters for more targeted and efficient issue resolution.

Create an environment group

To create an environment group, do the following:
  1. Go to SOAR Settings > Organization > Environments.
  2. Click the Groups tab.
  3. Click add Add.
  4. Enter the environment group name and description.
  5. Add as many environments to the group as required.

The created environment groups are dynamic and can be modified. To do this, select Manage Groups to edit existing groups, as needed.

Delete environment groups

Deleting an environment group doesn't delete its associated environments. However, if the deleted environment group is the only one associated with a playbook, the playbook is also deleted.