We have been using Alert Manager for a while now and for the most part will continue to use it moving forward. However I am wanting to know if there is a possibility to have seperate Alert Manager consoles for different tasks (I want to avoid having the "plain jane alerts" within each app if possible. For example we have the following scenario (these are made up to illustrate what I am trying to do):
- SOC Team 1 looks after Environment 1 "WORKSTATIONS"
- SOC Team 2 looks after Environment 2 "IOT"
Within the SPLUNK Serach Head I have an application for each team - "SOC Team 1" and "SOC Team 2" with their respective dashboards.
Our SPLUNK SIEM ingests logs for both and there are alerts (use cases) generated from both. I would like to have Alert Manager show alerts for the "WORKSTATIONS" environment to SOC Team 1 in Alert Manager but not be visible or shown to SOC Team 2 and vice-versa. Is there an option in Alert Manager to do this (I haven't seen anything specifically related to this)? Can the application be "cloned" as such so that I have 2 Alert Manager apps installed with the relevant configurations?
ES is something that will happen in the future but for the moment the focus is on this.
