Creating Virtual Tenants
What is a TrackMe Virtual Tenant
About TrackMe Virtual Tenants
In TrackMe, Virtual Tenants are basically similar to a Virtual instance of TrackMe which handles the application life cycle from A to Z.
A virtual tenant is an independent application space that can be dedicated according to your needs, addressing any of your requirements in terms of scoping and segmentation.
When you access TrackMe after the initial deployment, the application comes with no Virtual Tenants created yet.
Purposes of Virtual Tenants:
A specific segmentation which makes sense for you, a company or a country, a set of dedicated Splunk clusters or indexes
Specific TrackMe components
A space you want to dedicate for a given team, for example a dedicated space for your application monitoring teams
A technology related space, say a tenant handles firewall data for your security teams while another handles performance data for operational teams
Strong needs in role based access control, where different teams (addressed by different roles) are responsible for specific data spaces
And many more use cases
In TrackMe, a virtual tenant consists in the dynamic creation of all related knowledge objects through this interface, which allows you to perform their main setup such as root constraints, ownership and role based access control.
You can experiment, create, delete the entire space and related objects, disable and re-enable, update and change roles and ownership!
![screen1.png](_images/screen128.png)
Types of Virtual Tenants
In TrackMe, Virtual Tenants are linked to TrackMe components, the following types of Virtual Tenants are available currently:
splk-feeds Virtual Tenants, which include the following components (and can be enabled independently): splk-dsm / splk-dhm / splk-mhm
splk-wlk Virtual Tenants, which stands for the TrackMe Workload component
splk-flx Virtual Tenants, which stands for TrackMe Flex Magic components
splk-cim Virtual Tenants, which stands for TrackMe Common Information Model compliance tracking
Creating a Splunk Feeds (splk-feeds) Virtual Tenant
splk-feeds wizard
A wizard guides through the creation of a Splunk feeds tracking Virtual Tenant, these guides steps allow you to:
![splk_flx_welcome.png](_images/splk_flx_welcome.png)
define the name (tenant_id) and description of the tenant
choose which splk-feeds components will be enabled in the tenant (splk-dsm / splk-dhm / splk-mhm)
for each component, define its main options such as the target Splunk environment (local or remote), data discovery scope, custom break by, etc
define the Role Based Access Control policies (RBAC, administration and user roles, knowledge objects owner)
define the Virtual Tenant indexes
Tenant identifier (tenant_id), Tenant Alias (tenant_alias) and Description (tenant_desc)
Hint
Tenant Alias since TrackMe 2.0.83
Since TrackMe 2.0.83, you can define and update at any time the tenant alias
Unlike the tenant_id which is immutable, the tenant_alias can be updated at any time
The tenant alias is the name of the tenant as shown in the Virtual Tenant UI, it is also used to order the list of tenants in the UI
The alias is optionnally defined during the Virtual Tenant creation, and can later on be updated in Configure / Virtual Tenants account
In this step, you define the unique identifier for the tenant (tenant_id) and optionally and alias and its description:
The tenant_id is to be unique amongst all the created tenants and is immutable, this field name is used in every piece of data (events and metrics) generated by TrackMe. (Note: the tenant_id is an indexed field)
![screen2.png](_images/screen223.png)
splk-dsm
The component splk-dsm stands for Splunk Data Source Monitoring, it consists in tracking Splunk data with various powerful features, in a nutshell:
Tracking Splunk feeds from the lens of the index / sourcetype
Optionally, add a concept of custom break by to add a custom indexed or search type available field
TrackMe will then generate and maintain entities accordingly, generate Key Performance Indicators, track outliers behaviour (Machine Learning), Data quality, etc
![screen3.png](_images/screen311.png)
The main options to consider in the wizard:
Create tracker now: you can choose to create a tracker within the wizard and during the Virtual Tenant creation time, which creates an Hybrid Tracker. (Hybrid trackers can as well be created at any time in the Virtual Tenant)
Splunk deployment: you can set if the data is locally available, or if the target is a Splunk remote deployment
Splunk root search constraint: defines the root search constraint that applies for the discovery and management of feeds entities
Restrict indexes discovery: in addition with the root search constraint, you can define the indexes discovery using explicit and wildcard based index patterns
Advanced options: define settings for the Hybrid tracker, if enabled, and other component specific options if any (custom break by, etc)
Test now: allows you to test in preview the execution and entities discovery
local versus remote deployment:
In TrackMe, when defining Virtual Tenants and trackers, you can always choose between the local deployment, and a Splunk remote deployment if you have configured any,
When switching to a remote target, TrackMe will perform a connectivity and authentication test, and show the result:
![screen4.png](_images/screen410.png)
Testing the Hybrid tracker:
You can test your configuration at anytime using the “Test now” button, this performs a preview search accordingly to your target and settings:
![screen5.png](_images/screen59.png)
A notification will appear at the bottom of the screen depending on if there are entities that could be found or not.
Restricting indexes discovery:
You can restrict the scope of the Virtual Tenant, either by customising the root search constraint, or specifying indexes patterns:
Both the search constraint and indexes discovery configuration can be updated later on in the Virtual Tenant configuration.
Advanced options:
This screen allows you to customise the Hybrid tenant creation, as well as defining additional options specifics to the component.
![screen6.png](_images/screen67.png)
splk-dhm
The component splk-dhm stands for Splunk Data Host Monitoring, it consists in tracking Splunk data from the lens of an endpoint concept:
Track sourcetypes activity per endpoint
Define the concept of endpoint (default to the host Metadata, but can be updated to any custom field)
Monitor independently or as a whole the data availability per endpoint, apply policies, etc!
![screen7.png](_images/screen78.png)
The main options to consider in the wizard:
Create tracker now: you can choose to create a tracker within the wizard and during the Virtual Tenant creation time, which creates an Hybrid Tracker. (Hybrid trackers can as well be created at any time in the Virtual Tenant)
Splunk deployment: you can set if the data is locally available, or if the target is a Splunk remote deployment
Splunk root search constraint: defines the root search constraint that applies for the discovery and management of feeds entities
Restrict indexes discovery: in addition with the root search constraint, you can define the indexes discovery using explicit and wildcard based index patterns
Advanced options: define settings for the Hybrid tracker, if enabled, and other component specific options if any (custom break by, etc)
Test now: allows you to test in preview the execution and entities discovery
splk-mhm
The component splk-mhm stands for Splunk Metric Host Monitoring, it consists in tracking Splunk metrics from the lens of an endpoint concept:
Track metric categories availability per endpoint
Define the concept of endpoint (default to the host Metadata, but can be updated to any metric dimension)
Apply policies, etc
![screen8.png](_images/screen87.png)
The main options to consider in the wizard:
Create tracker now: you can choose to create a tracker within the wizard and during the Virtual Tenant creation time, which creates an Hybrid Tracker. (Hybrid trackers can as well be created at any time in the Virtual Tenant)
Splunk deployment: you can set if the data is locally available, or if the target is a Splunk remote deployment
Splunk root search constraint: defines the root search constraint that applies for the discovery and management of feeds entities
Restrict indexes discovery: in addition with the root search constraint, you can define the indexes discovery using explicit and wildcard based index patterns
Advanced options: define settings for the Hybrid tracker, if enabled, and other component specific options if any (custom break by, etc)
Test now: allows you to test in preview the execution and entities discovery
RBAC, ownership and indexes
Common to all Virtual Tenants, the final step allows you to define your RBAC policy, the knowledge object owner and the indexes that will be used in the scope of this Virtual Tenant:
![screen9.png](_images/screen95.png)
RBAC:
define the user roles required for the administration of the Tenant, users members of these roles can access and administrate the tenant
define the user roles required for the usage of the Tenant without modification privileges, users members of these roles can access the tenant but cannot perform any kind of modifications
Owner:
defines the Splunk user owning all the tenant related knowledge objects
executions of the Tracker for instance will be executed on behalf of this user
any further knowledge object, such as a new Hybrid tracker, that you would create later on will be automatically assigned to this user
Indexes:
defines the Splunk indexes for this tenant
the indexes need to have been defined prior to this step
splk-feeds REST
TrackMe provides a deep REST API for every action that is available in the application, for a full list of endpoints and options, consult the REST API reference user interface:
Navigation bar / API & Tooling / TrackMe REST API Reference
![screen10.png](_images/screen105.png)
![screen11.png](_images/screen1111.png)
Example, you can create a new Virtual Tenant for splk-dsm with the following SPL command:
| trackme url="/services/trackme/v2/vtenants/admin/add_tenant" mode="post" body="{ 'tenant_desc': 'Demo tenant', 'tenant_name': 'mytenant', 'tenant_roles_admin': 'trackme_admin', 'tenant_roles_user': 'trackme_user', 'tenant_owner': 'admin', 'tenant_idx_settings': 'global', 'tenant_dsm_enabled': 'true', 'tenant_dsm_sampling_obfuscation': 'disabled', 'update_comment': 'Created for the purpose of the documentation.'}"
![screen12.png](_images/screen129.png)
Creating a CIM compliance (splk-cim) Virtual Tenant
splk-cim wizard
When creating a new splk-cim Virtual Tenant, you only need to specify the tenant identifier and description, as well as the RBAC, ownership and indexes policies.
The configuration process of entities is handled once the tenant has been created within the Tenant user interface:
![splk_cim_welcome.png](_images/splk_cim_welcome.png)
![splk_cim_welcome2.png](_images/splk_cim_welcome2.png)
splk-cim REST
You can create a new splk-cim Virtual Tenant using the following SPL command:
| trackme url="/services/trackme/v2/vtenants/admin/add_tenant" mode=post body="{ 'tenant_desc': 'SIEM', 'tenant_name': 'mytenant', 'tenant_roles_admin': 'trackme_admin', 'tenant_roles_user': 'trackme_user', 'tenant_owner': 'admin', 'tenant_idx_settings': 'global', 'tenant_cim_enabled': 'true'}"
Creating an Splunk Flex Object (splk-flx) Virtual Tenant
splk-flx wizard
When creating a new splk-flx Virtual Tenant, you only need to specify the tenant identifier and description, as well as the RBAC, ownership and indexes policies.
The configuration process of entities is handled once the tenant has been created within the Tenant user interface:
![splk_flx_welcome.png](_images/splk_flx_welcome.png)
![splk_flx_welcome2.png](_images/splk_flx_welcome2.png)
splk-flx REST
You can create a new splk-wlk Virtual Tenant using the following SPL command:
| trackme url="/services/trackme/v2/vtenants/admin/add_tenant" mode=post body="{ 'tenant_desc': 'SIEM', 'tenant_name': 'mytenant', 'tenant_roles_admin': 'trackme_admin', 'tenant_roles_user': 'trackme_user', 'tenant_owner': 'admin', 'tenant_idx_settings': 'global', 'tenant_flx_enabled': 'true'}"
Creating a Splunk Workload Virtual Tenant
splk-wlk wizard
When creating a Splunk Workload Virtual Tenant, you will specify various options as the tracker configuration is handled during the Virtual Tenant creation phase:
![splk_wlk_welcome.png](_images/splk_wlk_welcome.png)
Splunk deployment type
![splk_wlk_create1.png](_images/splk_wlk_create1.png)
Define the type of deployment:
If you select Splunk Cloud, a tracker will be created to monitor the Splunk SVC consumption summary metrics.
Splunk deployment target
![splk_wlk_create2.png](_images/splk_wlk_create2.png)
Define the target:
If local, the searches are going to be performed locally, which the introspection, scheduler and other types of searches are running against data that can be searched on the Search Head hosting TrackMe
You can as well set a remote deployment account, which can target one or more Splunk REST API endpoints
TrackMe will adapt transparently searches as needed to use the splunkremotesearch command with the appropriate account
Root search constraint
Multiple Search Head Tiers
When you have multiple logical Search Head tiers (for intance a Search Head Cluster and one or more Standalone Search Heads), it is very important to restrict the root constraint and target only these Search Head members
To do so, ensure to use the host Metadata, either explicitly (host=myserver1 OR host=server2) or any equalivent technique of your choice (subsearch, lookups, etc)
You can for instance dedicate a Tenant per Search Head tier which is the easiest solution, alternatively you can also use the Grouping option and manual definition of the Workload trackers for advanced setups with multiple Search Head tiers within the same tenant
![splk_wlk_create3.png](_images/splk_wlk_create3.png)
Search constraint:
You can optionally define additional search filters to be used for the introspection, scheduler and Splunk Cloud SVC metrics
This can be useful to define the scope of the Workload tenant, filtering on Splunk applications or Splunk host related metadata (host, splunk_server)
ML Outliers
![splk_wlk_create4.png](_images/splk_wlk_create4.png)
Define ML outliers models at the entity discovery phase:
When TrackMe will discover entities, it can automatically create and train ML models
The default behaviour is to train ML models against the elapsed metric (the search run time from the introspection perspective)
Inactive entities
![splk_wlk_create5.png](_images/splk_wlk_create5.png)
Automatically purge inactive scheduled entities after a given period of time:
This settings influences the behaviour of the “inactive_entities” Workload tracker
When the tracker runs, it inspects entities which have not been active for a period of time, and depending on this value, it will automatically removes these entities from the KVstore collections
splk-wlk REST
You can create a new splk-wlk Virtual Tenant using the following SPL command:
| trackme url="/services/trackme/v2/vtenants/admin/add_tenant" mode=post body="{ 'tenant_desc': 'SIEM', 'tenant_name': 'mytenant', 'tenant_roles_admin': 'trackme_admin', 'tenant_roles_user': 'trackme_user', 'tenant_owner': 'admin', 'tenant_idx_settings': 'global', 'tenant_wlk_enabled': 'true'}"