Managing multitenant apps

IBM QRadar Assistant app 3.0.0 supports multitenant environments in QRadar 7.4.0 Fix Pack 1 or later.

With QRadar Assistant 3.0.0 or later, you can manage instance for these apps (such as IBM QRadar User Behavior Analytics, IBM QRadar Pulse, IBM QRadar Log Source Management) in a multitenant environment.

Important: You must have QRadar® administrator privileges to create, delete, and view a multi-tenanted app, such as User Behavior Analytics.

You can create multiple instances and associate one instance to a security profile. By assigning a domain to different security profiles, you can segregate the events and flows that from different instances. For example, you install a multitenant app "Hello App" in a multi-divisional organization and you want to create some security profiles such as "Green Office", "Blue Office" with different domains. After you create the security profiles, you create multiple instances like "Hello App-Green Office" and "Hello App-Blue Office" in a single shared deployment.

Use security profiles and user roles to manage privileges for large groups of users in your environment. Security profiles and user roles ensure that users have access to only the information that they are authorized to see.

Tip: If you are an admin with multiple tenants and security profiles, and you assigned an app instance to more than one security profile, hover over the app tab for each instance to see which security profile it is assigned to.

Multitenant apps

You can create multiple instances for a multitenant app to segregate different users. However, not every QRadar app supports multitenancy, or needs to have multiple instances. In most cases, you would have only one instance (default instance) after the extension is installed. The default instance is globally viewable for all users; you can assign the permissions in the user role settings in QRadar 7.3.1 or later.