--- title: "Sharing alerts between domains" canonical: "https://docs.devo.com/space/latest/1333526603/Sharing%20alerts%20between%20domains" format: markdown --- > Macro (toc) ## Purpose When using multitenancy, there may be many domains which need to view the same kind of alert. The multitenancy administrator may create the alert in each domain or create the alert only in a root domain. Creating the alert only in the root domain is easier. With sharing, a root domain’s triggered alerts can be displayed as triggered alerts in its child domains. If triggered alerts are shared, they are made available to domains when the `client` field in the triggered alert matches the [data access rules](https://devodocs.atlassian.net/wiki/spaces/latest/pages/144474216). This feature lets child domains monitor alerts configured in root domain level. ### Actions shared to child ### Actions restricted to root ## Security > Macro (excerpt-include) [Data access rules](https://devodocs.atlassian.net/wiki/spaces/latest/pages/144474216) are applied to alert rules when the rule starts by using the `client` field of the underlying data. For shared alert rules, data access rules are applied to the triggered alerts at the time they are triggered by using the `client` field of the triggered alert. Changing the data access rules while an alert is running will cause inconsistency. Manipulating the `client` field will also cause inconsistency. For example, if the expression ``` where eq(client,"child1@mssp") group select "child2@mssp" as client, last(raw) as message_from_child_1 ``` is used in a shared alert, data will be transferred from one child domain to another child domain. If a query must not be shared, do not share the alert using that query. For example, if there are two child domains, `child@mssp` and `secret@mssp`, if the shared alert uses the expression ``` where not eq(client,"secret@mssp") ``` then the string “secret@mssp” will be disclosed to `child@mssp`. To avoid this situation, manage data access by creating a new domain with the correct data access rules. Changes to data access rules and sharing are never retroactively applied to triggered alerts. If confidential information is inadvertently shared, it cannot be deleted from the child domain’s logs. ## What permissions do I need? ### Root domain - [Alert configuration](https://docs.devo.com/space/latest/529170511/Working+with+alert+definitions) [manage] - [Alert assigned to user](https://docs.devo.com/space/latest/94763463/Assign+resources+to+a+role) - [Finders](https://docs.devo.com/space/latest/94764298/Run+a+search+using+a+finder) [View] ### Child domain - [Triggered alerts](https://docs.devo.com/space/latest/405700609/Working+with+triggered+alerts) [view] - [Alert assigned to user](https://docs.devo.com/space/latest/94763463/Assign+resources+to+a+role) [view] ## Manage sharing Alert rules can be shared by enabling the **Multitenancy** option in the** New definition**, **New rule**, or **Edit alert definition **forms. ![10_Sharing alerts betweendomains.png](media://223eda21-d452-408c-8bee-5d1ef0d3cf71) You can manage sharing options for your already triggered alerts and created rules from the **Rules** tab in the Alerts section. ![20_Sharing alerts between domains.png](media://d1457d30-90e9-47c8-8ea9-c7d8b1f8d0fc) ## Access rule examples #### New child domains inherit shared alerts from root domain If triggered alerts from *root@mssp* are shared with the *child1@mssp* using “[all domains](https://devodocs.atlassian.net/wiki/spaces/latest/pages/144474216)” access and a new domain *child2@mssp* is created, triggered alerts will be shared with *child2@mssp.* #### Nested data access rules If - domain *1@mssp* has “[specific domain](https://devodocs.atlassian.net/wiki/spaces/latest/pages/144474216)” access to *2@mssp* *and* - domain *2@mssp* has “specific domain” access to *3@mssp*, then *1@mssp* can share triggered alerts with *2@mssp* but not *3@mssp*. ## Viewing alerts From the **Alerts-> Overview** tab, an icon appears next to the alert name to indicate the alert is shared from another domain. Root domains have a “Domain” field indicating which child has received the alert. ![30_Sharing alerts between domains.png](media://54c622d8-c63f-453b-a5fe-296ff30dc2d2) Child domains have a “Shared from root domain” field indicating the name of the root domain. ![40_Sharing alerts between domains.png](media://f01fe65f-426f-447a-aab9-cac5143fe079) Shared alerts cannot be selected using the *Category *and *Subcategory* filters. They can be selected with other filter options. ## Monitoring it - Alert IDs are the same in the parent and child domains. - Child domains will be able to review all the domain triggered alerts, including those shared by the root domain, from the [siem.logtrust.alert.info](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95206409) table. If sharing is enabled, the *client* is the child and the *domain* is the root where the alert is configured. If sharing is not enabled, *client* and *domain* are the domain where the alert is configured. ![50_Sharing alerts between domains.png](media://0b21951e-2057-4401-8f39-05609ddd3d3b) - The [devo.audit.alert.definition](https://docs.devo.com/space/latest/1276772356/Audit+logs) table allows monitoring those changes performed over the alert rules. In the case of shared alerts, this information will be accessible only from the root domain. > Macro (excerpt-include) ![60_Sharing alerts between domains.png](media://4fc5eadf-18fb-4369-b46f-435247aedb86) ## Troubleshooting ### “Open query” returns an error in the child domain If the alert’s query requires a resource, such as a lookup, which is available in the parent domain but not the child domain, then the child domain will not be able to open the query for a shared triggered alert. ### “Open query” returns different results in the child domain If the query modifies the `client` field, the results in the child domain will not match the results in the shared triggered alert. If both the root domain and the child domain have a particular resource which is used by the query, such as a lookup, the resource may be different in the two domains. Then the results in the child domain will not match the results in the shared triggered alert. ### Domain is “N/A” In a root domain, “N/A” will appear in the domain field if the query did not return a `client` field. For example, if the query is ``` from siem.logtrust.collector.counter group ``` then the result will not contain a `client`.