topic Re: Segregate notable in Single ES deployment in All Apps and Add-ons

Segregate notable in Single ES deployment

Nawab — Tue, 05 Mar 2024 09:11:41 GMT

Let suppose, we want to create a dashboard on notable index, which is shared with all team, but we want to create a dashboard for every team to see notables related to them.

But we want to restrict them to only see this specific search and they can not even change the search when they click the search icon on the dashboard.

is it possible?

or how can we segregate notable in a single ES deployment?

Re: Segregate notable in Single ES deployment

gcusello — Tue, 05 Mar 2024 09:54:02 GMT

Hi @Nawab,

ES isn't multitenant and you are asking how to use ES in multitenancy!

you have to create a custom dashbord that accesses the Notable index,

The real problem is how to profilate the users, you could use e.g. sourcetype or another field in the Notable index.

You should customize all the Correlation searches to write a field in the Notable index to identify notables for each users.

Ciao.

Giuseppe

Re: Segregate notable in Single ES deployment

Nawab — Tue, 05 Mar 2024 10:03:40 GMT

I can do that, but a use case modify the search and see all notables not related to him. how can i stop user to modify search

Re: Segregate notable in Single ES deployment

gcusello — Tue, 05 Mar 2024 10:46:18 GMT

Hi @Nawab,

you can disable the edit button and don't give grants to modify the view to the role used by these users.

Ciao.

Giuseppe

Re: Segregate notable in Single ES deployment

Nawab — Tue, 05 Mar 2024 11:44:44 GMT

yeah, still he can click on search icon and modify the search in search app

Re: Segregate notable in Single ES deployment

gcusello — Tue, 05 Mar 2024 12:03:55 GMT

Hi @Nawab,

disable the Open in Search feature.

Ciao.

Giuseppe

Re: Segregate notable in Single ES deployment

Nawab — Tue, 05 Mar 2024 12:14:53 GMT

can you let me know how

Re: Segregate notable in Single ES deployment

gcusello — Tue, 05 Mar 2024 13:29:31 GMT

Hi @Nawab,

in the panl's optins add

<option name="link.openSearch.visible">false</option>

Ciao.

Giuseppe