Domains and log sources in multitenant environments
Use domains to separate overlapping IP addresses, and to assign sources of data, such as events and flows, into tenant-specific data sets.
When events or flows come into IBM® QRadar®, QRadar evaluates the domain definitions that are configured, and the events and flows are assigned to a domain. A tenant can have more than one domain. If no domains are configured, the events and flows are assigned to the default domain.
Domain segmentation
- Event and flow collectors
- Flow sources
- Log sources and log source groups
- Custom properties
- Scanners
A multitenant deployment might consist of a basic hardware configuration that includes one QRadar Console, one centralized event processor, and then one event collector for each customer. In this configuration, you define domains at the collector level, which then automatically assigns the data that is received by QRadar to a domain.
To consolidate the hardware configuration even further, you can use one collector for multiple customers. If log or flow sources are aggregated by the same collector but belong to different tenants, you can assign the sources to different domains. When you use domain definitions at the log source level, each log source name must be unique across the entire QRadar deployment.
If you need to separate data from a single log source and assign it to different domains, you can configure domains from custom properties. QRadar looks for the custom property in the payload, and assigns it to the correct domain. For example, if you configured QRadar to integrate with a Check Point Provider-1 device, you can use custom properties to assign the data from that log source to different domains.
Automatic log source detection
When domains are defined at the collector level and the dedicated event collector is assigned to
a single domain, new log sources that are automatically detected are assigned to that domain. For
example, all log sources that are detected on Event_Collector_1
are assigned to
Domain_A
. All log sources that are automatically collected on
Event_Collector_2
are assigned to Domain_B
.
When domains are defined at the log source or custom property level, log sources that are automatically detected and are not already assigned to a domain are automatically assigned to the default domain. The MSSP administrator must review the log sources in the default domain and allocate them to the correct client domains. In a multitenant environment, assigning log sources to a specific domain prevents data leakage and enforces data separation across domains.