Tenants

The Anomaly Detection System (ADS) respects tenants defined in the Flowmon Configuration Center (Flowmon Configuration Center → System → User Settings → Tenants). Therefore, it is possible to use the system simultaneously by multiple tenants without any awareness of each other. In the Flowmon Configuration Center, it is possible to set which flow sources or profiles a tenant has access to. These flow sources or profiles can be then assigned to a particular data feed in the ADS. Using a multi-tenant environment in ADS has certain specifics that must be mentioned:

• Syslog messages: Flowmon ADS allows you to send detected events using Syslog. Complete information about Syslog can be found on the dedicated Event Response page. Currently, there are two options for how Syslog can be configured in the ADS (using the Target option in Settings → Processing → Syslog message):

  • Flowmon OS settings: When this option is selected, the Syslog will respect the configuration that is set in the Flowmon Configuration Center → System → System Settings → Syslog Event Logging. Note that this configuration is system-wide and can be set in the Base tenant by a user with an administrator role assigned. The tenants that configure their Syslog to respect the Flowmon OS settings will then send detected events to the same Syslog servers that were configured by the Base tenant administrator.

  • ADS syslog sender: This option allows you to set an IP address of a target Syslog server, target port, and transport protocol in each tenant individually - completely independent of the system-wide configuration.

• SNMP messages: Only users with a role that is assigned with tenant administrator privileges can create SNMP reports in a multi-tenant environment (roles can be configured in FCC → System → User Settings → Roles). This is because only tenant administrators have access to SNMP target groups. These groups are used to define devices that should receive the SNMP reports. The groups can be configured in Flowmon Configuration Center → System → System Settings → SNMP Event Logging. For more information about SNMP reports, see the following page: Event Response.

• Visibility in a multi-tenant environment: Users can only see data (configuration, reported events, and so on) from the tenant they are members of. To see data from subtenants, you must switch to a respective subtenant - the data from subtenants are not visible in their parent tenant.

• Access rights in a multi-tenant environment: Each user's access rights are determined by the user's role and by the tenant of which the user is a member. The detailed description of access rights can be found on a separate page: User Permissions.

• License limit sharing: The amount of Flows Per Second (FPS) that Flowmon ADS can process and the number of data feeds are limited by license. The license limit is shared by all tenants. The FPS can be limited on the data feed level. More information can be found on the data feeds page.

• Migration to a multi-tenant environment: For details on how data is migrated during the upgrade to a multi-tenant version of the ADS, refer to the following section: Migration to a multi-tenant environment.

• Configuration import: An Anomaly Detection System that operates in multi-tenant mode allows you to import configuration exported from a non-tenant environment. This might be useful when you want to manually migrate a standalone Flowmon appliance to a shared multi-tenant environment. The configuration can only be imported by a user from the Base tenant with tenant administrator rights. The configuration is always imported into the selected tenant. Therefore, ensure that before the import you are in the intended tenant because this operation may overwrite the settings of the respective tenant.

• REST Application Programming Interface (API): REST API calls only work in the tenant that the user was created in. Currently, there is no API call to switch tenant. This means that the Base tenant administrator cannot switch to the subtenant to adjust the configuration using the REST API.

• Browser tab refresh after switching to a different tenant: When working in multiple browser tabs and switching to a different tenant in one tab, refresh the other tabs to prevent unexpected issues when making changes in tabs where the tenant was not manually switched.