Table of Contents | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Overview
Currently, data access across domains affects only query data. Users in a root domain will be able to see events from data tables in all their child domains. The rest of the resources and assets are still domain-independent.
When a user in a root domain accesses the Data search area, they will see not only their own tables in the finder but all the tables with data in all their child domains.
...
If a user in the root domain accesses a data table that contains events from different domains, they will see the owner of each specific event in the clientcolumn. This column will be added to all the tables in a root domain and is always located next to the eventdate column.
...
The users in the root domain will see the client column in all the queries, no matter the method used (Data search, Query API, Activeboards, Flow, OData feeds…)
...
All the Devo activity of the child domains in the
siem.logtrust.web.activity
table. Find more info about this table in this article.All the ingestion metrics of the child domains in the
siem.logtrust.collector.counter
table.All the alerts triggered in the child domains in the
siem.logtrust.alert.info
table. Find more info about this table in this article.Access to all the data in the child domains using the global search.
Note |
---|
Note that root domains will not see any data from their child domains in the widgets of the Devo Home area. Also, root domains won’t have access tomy.* tables owned by their child domains (such as my.app.* or my.synthesis.* ). If you need to see data from a my.app.* table owned by one of your child domains, you can access the my.app table and define a custom table that contains only the data from that child (the my.app table contains the data from all the my.app.* tables created by all the domains in the multitentant structure) |
Custom tables in root domains
my.app
and my.upload
tables defined in child domains will be also automatically available in the parent domain.
Besides, admin users in a root domain can define new my.app and my.upload tables directly from the finder. To do it:
Rw ui steps macro | ||||
---|---|---|---|---|
Log in to your multitenant root domain and go to Data search.
In the Explore your data → Finders area, click the … button next to your finder name and click Add table definition.
In the window that appears, select the type of table you want to define (
The new defined table will appear in the root domain finder once it starts receiving data. |