Federated Search

Federated search enables you to query and retrieve data across multiple managed organizations (tenants) from a single interface. The Anomali platform supports federated search by leveraging the Managed Security Service Providers (MSSP) feature, which allows your organization to manage its customers as multiple sub-organizations, streamlining data, features, investigations, and reporting while maintaining data isolation between customers.

How federated search works

As an MSSP org admin, federated search allows you to search across multiple customers at once, such that each sub-organization's data remains separate and is not shared across other organizations.

To ensure unique identification, a federated search adds two federated fields to the search results:

  • managed_customer_id: A string that denotes the organization ID of the managed customer where the data originated.

  • managed_customer_name: A string that displays the name of the managed customer.

These federated fields can be referenced in queries to differentiate results by organization.

Additionally, an an MSSP org admin, you can also use the dropdown next to the Search bar to filter the results specific to a sub-organization. Selecting such a sub-organization from the list assumes the environment, users, results, and settings specific only to that sub-organization.

Best Practices

Lookup Tables

You can use the federated fields in your AQL query like any regular query, since these fields are included in the eventlog schema as well as all lookup table.

Subsearch

When running a federated search with multiple managed organizations, you cannot use the RIGHT join. Anomali recommends that you either use a LEFT join, an INNER join, or reduce the search scope to only one organization.

Examples

Example 1: As an MSSP, issue a federated search like any regular AQL Search query to see consolidated results across multiple sub-orgs.

Copy 
| where sourcetype contains_ci ("ts", "carbon", "nets") 

Example 2: federated fields in an AQL query

Copy 
|aggr count by managed_customer_name