/
Which data can a root domain access?
Document toolboxDocument toolbox

Which data can a root domain access?

Owned by Juan Tomás Alonso Nieto (Deactivated)
Last updated: Jan 22, 2025 by Julio Vargas
3 min read
[ 1 Overview ] [ 2 Custom tables in root domains ]

Overview

Currently, data access across domains affects only query data. Users in a root domain will be able to see events from data tables in all their child domains.

  • When a user in a root domain accesses the Data search area, they will see not only their own tables in the finder but all the tables with data in all their child domains.

Note that the table demo.ecommerce.data won’t show any data in root domains. It won't appear in your finder and you will get an error if you try to query it using a free text query.

  • If a user in the root domain accesses a data table that contains events from different domains, they will see the owner of each specific event in the client column. This column will be added to all the tables in a root domain and is always located next to the eventdate column.

It is important to mention that all the roles in the root domain will have access to the same data according to the rules set. If you need to limit access for specific roles in the domain, you can use custom finders and custom tables.

Also, note that a root domain will always have access to the following information by default:

  • All the Devo activity of the child domains in the siem.logtrust.web.activity table. Find more info about this table in this article.

  • All the ingestion metrics of the child domains in the siem.logtrust.collector.counter table.

  • All the alerts triggered in the child domains in the siem.logtrust.alert.info table. Find more info about this table in this article.

  • Access to all the data in the child domains using the global search.

Custom tables in root domains

my.synthesis tables

Synthesis tables belong to a specific domain only. Synthesis in the child won’t be visible from the root domain. New synthesis can be created directly in the root.

my.app and my.upload tables

The data inside all the my.app.* and my.upload.* in the child domains will be automatically available in the root domain querying the two-level tables my.app and my.upload respectively.

Besides, admin users in a root domain can create a new my.app.* or my.upload.* table directly from the finder. To do it: