Segregate notable in Single ES deployment

[Nawab]

Let suppose, we want to create a dashboard on notable index, which is shared with all team, but we want to create a dashboard for every team to see notables related to them.

But we want to restrict them to only see this specific search and they can not even change the search when they click the search icon on the dashboard.

is it possible?

or how can we segregate notable in a single ES deployment?

[Nawab]

can you let me know how

[gcusello]

Hi @Nawab,

in the panl's optins add 

<option name="link.openSearch.visible">false</option>

Ciao.

Giuseppe

[gcusello]

Hi @Nawab,

ES isn't multitenant and you are asking how to use ES in multitenancy!

you have to create a custom dashbord that accesses the Notable index,

The real problem is how to profilate the users, you could use e.g. sourcetype or another field in the Notable index.

You should customize all the Correlation searches to write a field in the Notable index to identify notables for each users.

Ciao.

Giuseppe

[Nawab]

I can do that, but a use case modify the search and see all notables not related to him. how can i stop user to modify search

[gcusello]

Hi @Nawab,

you can disable the edit button and don't give grants to modify the view to the role used by these users.

Ciao.

Giuseppe

[Nawab]

yeah, still he can click on search icon and modify the search in search app

[gcusello]

Hi @Nawab,

disable the Open in Search feature.

Ciao.

Giuseppe