# Multiple Different Clients **URL:** \ **Category:** SIEM\ **Created:** [December 17, 2020, 1:35am UTC](https://discuss.elastic.co/t/multiple-different-clients/258935 "2020-12-17T01:35:15Z")\ **Posts on this page:** 1\ **Showing post:** 4
**Author:** ![SanWieb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sanwieb/32/75948_2.png) [@SanWieb](https://discuss.elastic.co/u/SanWieb)\ **Post date:** [December 30, 2020, 11:15am UTC](https://discuss.elastic.co/t/multiple-different-clients/258935/4 "2020-12-30T11:15:39Z")
Hi all, > [@Mike\_Paquette](#): > > Update the detection rules in each tenant Space to point to only tenant-specific index patterns I think it is not needed to change each detection rule for each tentant to the tenant-specific index patterns. I played some around with the multi-tenancy options. I discovered that when you create a rule with a user which has only access to specific tentant indexes it queries (signals) only on those indeces. So: - Create a Kibana Space for the tenant, let say 'companyA' - Create a user with a role which has: o Cluster privileges: manage o Index privileges: indeces: \*companyA\*, privileges: all o Kibana: for the space 'companyA' all privileges except for the ingest manager - Add to all indices names the space-id after the indices, so for beats:` ‘%{[@metadata][beat]}-%{[@metadata][version]} -%{+YYYY.MM.dd}-companyA` Now log in with the tentant user and load the pre-build rules or create one. The rules will only query the indices where the rule creater has acces too. But watch out when you log in with a superuser / administrator which has access to all indices. If you create a rule for a tentant you are the creator of the rule and so will the rule query all indices. Then it is possible that you have a signal for companyB in .siem-signals-companyA. So only add rules with a user which has only access to the tentant indices. --- _[View the full topic](https://discuss.elastic.co/t/multiple-different-clients/258935)._