Multi-tenancy in ES 8+

Elastic Security SIEM
1

Hi there

I'm the process of architecting out a SIEM-as-a-service offering using Elasticsearch+Fleet, but I'm having a hard time finding good, recent documentation on multi-tenancy for modern versions of Elasticsearch and/or Kibana. Everything on Google seems to point to either Opendistro/opensearch, or much older versions of Elasticsearch.

As near as I can tell, multi-tenancy would currently be implemented by employing Fleet Namespaces, Kibana spaces, roles, and document-level/attribute-based-security, but again, there's not good information on how to configure or set that up, or what pitfalls and gotchas to watch out for. Any information on how to best accomplish this would be great appreciated.

2

Opendistro is an AWS run product and differs from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

Opensearch is an AWS run product and differs from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

3

There is not much besides what you already mentioned.

You would need to use Kibana Spaces and configure the roles for each user.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.