# Xpack RBAC vs Kibana Instances/Spaces vs SIEM **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, elastic-stack-machine-learning\ **Created:** [January 17, 2020, 10:38am UTC](https://discuss.elastic.co/t/xpack-rbac-vs-kibana-instances-spaces-vs-siem/215439 "2020-01-17T10:38:07Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [January 17, 2020, 10:38am UTC](https://discuss.elastic.co/t/xpack-rbac-vs-kibana-instances-spaces-vs-siem/215439/1 "2020-01-17T10:38:08Z")
Got some architectural questions concerning security. Currently ingesting documents tagged with tenant ID fields into shared indices (winlogbeat-_, auditbeat-_ etc.) for SIEM purposes for our SOC. Would like to grant access individual tenants access to their specific documents only while our SOC continue to have access across all documents. Could we create Xpack Roles with fixed tenant filters to limit document access through the ’Granted documents query’ under ‘Grant read privileges to specific documents’? If above is possible would so a role fixed tenant filter also have the same effect in the SIEM App, so an individual tenant only would see their own documents and anormalities? Could we possible create a role filter which picked one or more values for the 'granted document query' say from a ldap realm? So we wouldn't have to create per tenant role, but could administer tenant attribute values to filter documents in a ldap directory? Wondering if we just should create a Kibana Space per tenant or if it would be best for scalability to create individual Kibana instances possible with their own .kibana index... though not sharing the .kibana index properly would be an issue for ML and SIEM Timelines, right? TIA ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 20, 2020, 7:30am UTC](https://discuss.elastic.co/t/xpack-rbac-vs-kibana-instances-spaces-vs-siem/215439/2 "2020-01-20T07:30:47Z")
> [@stefws](#): > > Could we create Xpack Roles with fixed tenant filters to limit document access through the ’Granted documents query’ under ‘Grant read privileges to specific documents’? Yes, you can do this. This is referred to as _[Document Level Security](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/field-and-document-access-control.html)_ in Elasticsearch. > [@stefws](#): > > If above is possible would so a role fixed tenant filter also have the same effect in the SIEM App, so an individual tenant only would see their own documents and anormalities? DLS is applied at the elasticsearch level, so any product that queries from the original indices, as the logged in user, will reflect the user's document limits. This will apply in SIEM. However, when you refer to `anormalities`, I presume you mean machine learning anomaly detection. That is a little trickier - ML reflects the security limits of the user that created the detection job, not the user that is viewing the anomalies themselves. So, unless you create new anomaly detection jobs for each tenant, I don't think you will get the results you are looking for. However, perhaps one of the ML specialists might chime in with a solution. > [@stefws](#): > > Could we possible create a role filter which picked one or more values for the 'granted document query' say from a ldap realm? Yes, see [DLS query templates](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/field-and-document-access-control.html#templating-role-query). ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [January 20, 2020, 8:38am UTC](https://discuss.elastic.co/t/xpack-rbac-vs-kibana-instances-spaces-vs-siem/215439/3 "2020-01-20T08:38:28Z")
Thanks for your reply @TimV Concerning ML, I understand it stores anormalities in it's own seperat indices and they will of course not be tagged with tenant IDs as the ML results are generally across all documents of selected indices traversed. ML is properly hard to virtualize/sliceNdice while preserving our SOC overall access. Timelines are stored in .kibana index as I understand it, even though we may control retention time of ML results with results\_retention\_days. How can we manage TimeLines live cycles, so .kibana index doesn't just grow wild over time? Any thoughts on the other questions? > [@stefws](#): > > Could we possible create a role filter which picked one or more values for the 'granted document query' say from a ldap realm ? > So we wouldn't have to create per tenant role, but could administer tenant attribute values to filter documents in a ldap directory (or some other source be it an elastic index, an SQL table, flat file all mapping auth user name to tenant ID(s) to filter documents by)? > > Wondering if we just should create a Kibana Space per tenant or if it would be best for scalability to create individual Kibana instances possible with their own .kibana index... though not sharing the .kibana index properly would be an issue for ML and SIEM Timelines, right? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 17, 2020, 8:38am UTC](https://discuss.elastic.co/t/xpack-rbac-vs-kibana-instances-spaces-vs-siem/215439/4 "2020-02-17T08:38:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.