You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook.

In Google Security Operations, the SOAR component allows for the configuration of organizational environments. This is the designated feature for defining internal network segments by name and associated CIDR ranges. When alerts are ingested, the system automatically correlates IP address entities against these configured networks. This enriches the alert data with environmental context, such as the specific network name. This pre-processed information is then available to be used directly as a condition within playbook triggers, allowing for automated workflows to be initiated based on whether an IP is internal and which named network it belongs to.

B. Modify the entity attribute in the alert overview. This is a manual, per-alert action performed by an analyst and does not provide the required systematic, automated labeling needed for a playbook trigger.
C. Create an outcome variable in the rule to assign the network name. This is inefficient as it requires embedding and maintaining network logic within every detection rule instead of using the central platform setting designed for this purpose.
D. Enrich the IP address entities as the initial step of the playbook. Enrichment occurs after a playbook is triggered. The network name is required for the trigger itself, so the information must be available before the playbook begins execution.

1. Google Cloud Documentation - Chronicle SOAR - Manage environments:

Reference: In the "Manage environments" section

the documentation states

"The Environment is used to map assets and define network segments in your organization. This information is used by the system to identify which assets are internal and which are external

and to provide context to the analyst." This directly describes the process of configuring networks to label entities.

Source: https://cloud.google.com/chronicle/docs/soar/settings/manage-environments

2. Google Cloud Documentation - Chronicle SOAR - Create and manage playbooks:

Reference: The "Triggers" section explains how playbook execution is initiated based on specific conditions. These conditions evaluate alert and entity attributes. For the network name to be used as a trigger

it must exist as an attribute on the entity when the alert is evaluated

which is accomplished by pre-configuring the environment as described in Option A.

Source: https://cloud.google.com/chronicle/docs/soar/playbooks/create-and-manage-playbooks#triggers