We are looking to provide an MSSP type of service and build an XDR service, currently looking to explore how data of each tenant can be stored in chronicle SIEM, and then the automation part can be connected with chronicle SOAR. Basically, we are trying to understand how the multi-tenancy can be managed from chronicle SIEM.
How can chronicle SIEM be used for storing data of multiple tenants?
+10Hi,
Please reach out to your Google account team to inquiry about multi-tenancy since that involves creating new SIEM instances and linking them together to the main SIEM instance. Thank you!
E.g.
1. How can we achieve multi-tenancy using MSSP (Multiple Instances) and Single-Instance options? How do they compare to each other?
2. How does the data residency work for each option and what other data residency options exist? Can I ingest and store my data in multiple regions (data residency) while using all the for the very same SIEM/SOAR instance with RBAC for feature and data access controls?
+10Hi
When I answered this question over 2 years ago, we had a limited version of multi-tenancy for a few customers.
We do not have public documentation about multi-tenancy since it’s not a feature that was fully built. We do have MSSPs that have multiple tenants. The way that this is accomplished is there is a parent tenant (MSSP instance) that can create other SIEM instances (tenants) via the SIEM Management API. These tenants are linked to the MSSP instance.
The parent tenant can only create tenants in the region where it exists. For example, a MSSP instance in the Europe region can only create tenants in this region.
All of the data is stored in its own SIEM instance. MSSP can access the data via Federated search.
For more detailed information, please reach out to our Sales team and they can work with you.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.