Hi everyone! 👋 I've been learning about SIEM tools for a managed service provider (MSP) context. I'm trying to understand if Exabeam is a strong option when you have multiple clients (tenants) to manage.
From my beginner research, I know data isolation and separate reporting are super important. Could anyone share concrete examples of how Exabeam handles multi-tenancy? Like, is it mostly about setting up separate "parks" or are there other architectural things to consider? I'd really appreciate any beginner-friendly explanations or gotchas you've encountered. Thanks in advance to anyone who can help!
You've hit on a critical requirement for MSPs. Setting up separate "parks" for each tenant is indeed a core part of the architecture for data isolation. Each tenant's data, users, and associated threats are completely siloed by default, which covers your primary concern.
One architectural nuance to consider is how you'll manage the operational overhead. While the separation is clean, you'll still need a process for things like centralized rule and model updates across all your client parks. Some teams find they need to script certain maintenance tasks to keep things efficient at scale.
A potential gotcha is licensing and cost structure when scaling to many smaller tenants, as that can get complex quickly. Have you looked at how many distinct client environments you'd be planning to deploy?
—HR