Page Comparison

Overview

Currently, data access across domains affects only query data. Users in a root domain will be able to see events from data tables in all their child domains.

...

• If a user in the root domain accesses a data table that contains events from different domains, they will see the owner of each specific event in the clientcolumn. This column will be added to all the tables in a root domain and is always located next to the eventdate column.

...

• The users in the root domain will see the client column in all the queries, no matter the method used (Data search, Query API, Activeboards, Flow, OData feeds…)

...

• All the Devo activity of the child domains in the siem.logtrust.web.activity table. Find more info about this table in this article.

• All the ingestion metrics of the child domains in the siem.logtrust.collector.counter table.

• All the alerts triggered in the child domains in the siem.logtrust.alert.info table. Find more info about this table in this article.

• Access to all the data in the child domains using the global search.

Custom tables in

...

root domains

...

my.app

...

and my.upload tables defined in child domains will be also automatically available in the parent domain.

...

Besides, admin users in a root domain can define new my.app and my.upload tables directly from the finder. To do it:

Rw ui steps macro

Rw step Log in to your multitenant root domain and go to Data search. Rw step In the Explore your data → Finders area, click the … button next to your finder name and click Add table definition. Image Added Rw step In the window that appears, select the type of table you want to define (my.app or my.upload), and then set the rest of tag levels. Click Add once you finish. Image Added Rw step The new defined table will appear in the root domain finder once it starts receiving data.