Deep Dive · MSSP & Multi-Tenant

Two products. One foundation.

Fleet Command lets a single customer see across their own branches. MSSP Multi-Tenancy lets a security provider see across many customers. Both ride the same engine: per-tenant appliance isolation, periodic summary publishing, scoped grouping, edition-flag activation. The difference is who logs in, where, and what they are allowed to see.

Two Products at a Glance

Different audiences. Different consoles. Same engine.

Customers run SIEMonster Edge across many branches and want one console. Security providers run SIEMonster Edge across many customers and want one console too. Same problem statement, different audience. So we built two surfaces on top of one engine.

Fleet Command

One customer. Many branches.

A single organisation runs SIEMonster Edge across multiple sites: head office, datacentres, remote offices. The customer’s own SOC team logs into one dashboard, hosted on their primary appliance, and sees every branch.

  • Customer-facing: their analysts, their console.
  • Embedded in the customer’s primary appliance.
  • Fixed scope: a fleet = the customer’s branches.
  • One login: their existing SOC credentials.
MSSP Multi-Tenancy

Many customers. One provider.

A managed security services provider operates SIEMonster Edge for many independent customers. Their analysts log into a dedicated console and tick on or off any subset of those customers, with full hierarchy support for partner-MSSPs.

  • Provider-facing: MSSP analysts, dedicated console.
  • Hosted at the provider URL (e.g. mssp.edg3.io).
  • Dynamic scope: an analyst session ticks customers on or off.
  • Recursive: partner-MSSPs nest inside parent MSSPs.

What makes this work

Both products sit on the same primitives: per-tenant appliance isolation, periodic summary publishing, scoped grouping, edition-flag activation. The difference is who logs in, where, and what they are allowed to see.

Scenario · Fleet Command

Acme Corp. Three offices, one console.

Acme runs SIEMonster Edge in three places. London is the primary appliance. Cape Town is a datacentre. Sydney is a remote site. Every branch detects locally, contains locally, then publishes a summary up to London on a schedule. The Head of Security in London opens one dashboard and sees the whole company.

ACME CORP · single customer, three branches
Primary

London HQ

edg3-acme-lon.local

Edge appliance · isolated · local detection · hosts the Fleet Command Dashboard

Branch

Cape Town DC

edg3-acme-cpt.local

Edge appliance · isolated · local detection · publishes to London

Branch

Sydney Site

edg3-acme-syd.local

Edge appliance · isolated · local detection · publishes to London

What Acme’s Head of Security sees

One dashboard. Three branches at a glance. “London is fine, Cape Town has a SCADA spike, Sydney’s compliance score dipped overnight.” No more flipping between three separate consoles to get the picture, no per-site logins, no stitch-it-together emails between branch SOC analysts.

Scenario · MSSP Multi-Tenancy

Apex Security Group. Twelve customers, one console.

Apex is an MSSP. They run SIEMonster Edge for twelve independent customers across finance, health, retail, energy, ICS and maritime. Each customer has its own dedicated appliance and its own data. Apex’s analysts log into mssp.edg3.io and tick on or off any subset of those twelve.

MSSP CONSOLE · Apex Security Group · mssp.edg3.io
Acme Banktenant_a
Beacon Healthtenant_b
Cobalt Logisticstenant_c
Delta Energytenant_d
Echo Retailtenant_e
Fjord Maritimetenant_f
Gulf Utilitiestenant_g
Helix ICStenant_h
Iris Financetenant_i
Jet Air Cargotenant_j
Kelp Aquaculturetenant_k
Lumen Telcotenant_l

What Apex’s analysts see

One console. Tick three customers and the entire console re-scopes to those three. Tick all twelve and roll-up KPIs blend across the book. Acquire another MSSP next quarter and the same console scales to twenty without any new infrastructure. A senior analyst can delegate the financial-services customers to a junior, who sees a properly scoped view with the same tools.

Storage Tiers · Multi-Tenancy by Column

Hot NVMe. Cold lake. tenant_id is a column.

The lake is one schema in three storage tiers. Tier 1 and Tier 2 sit on local NVMe inside each tenant’s appliance. Tier 3 sits in customer-owned object storage. All three carry the same Parquet schema. tenant_id is a column on every row. Multi-tenancy is enforced by the database, not by the UI.

Tier 1 · real-time verdicts
Already-reasoned decisions, not raw logs.
~0.1%
On-agent reasoning fires sub-second. Verdicts go to the SOC pane in milliseconds.
NVMe (hot) · <100ms latency · drives Signals · Breach HUD · Slack approvals
Tier 2 · correlated context
The window of raw events around each verdict.
5–15%
Sixty seconds before and after each Tier 1 event, across process, network, file, registry.
NVMe (warm) · seconds · drives forensic drill-down on the agent detail page
Tier 3 · full archive
Every event, ZSTD-compressed Parquet, customer-owned storage.
100%
Process starts, DNS, file writes, network connections. 15-minute batch cadence to the lake.
Object storage (cold) · cheap by design · 7 years of retention · Time Machine queries

One lake. Tenants by column.

Every row in the lake carries a tenant_id. A customer’s session sees only rows where the tenant_id matches their tenant. An MSSP analyst’s session sees rows for whichever tenants they have. There is no second copy of the data per tenant. There is no per-tenant database to spin up. The lake itself does the policing.

parquet schema · every row stamped with tenant_id
tenant_id event_time host rule_id severity
tenant_a03:31:18art-dcsl14T1003.001critical
tenant_b03:31:42bcn-edr-09T1110.003medium
tenant_a03:32:05fin-jump-04T1059.001high
tenant_c03:32:14cob-fw-01T1071.001low
tenant_d03:32:51dlt-scada-7T0809high
tenant_a03:33:09art-dcsl14T1003.001critical
tenant_b03:33:20ehr-app-22T1110.003medium
tenant_e03:33:48ret-pos-12T1486critical
Customer query: WHERE tenant_id = 'b'
MSSP query: WHERE tenant_id IN ('a','b','c','d','e')

Single pane of glass is a query, not a copy

Customer A only ever sees rows where tenant_id = ‘a’. Apex’s MSSP analysts see the rows for whichever tenants they have. The lake itself enforces it. There is no second copy of the data per tenant. There is no per-tenant database to spin up. One lake, one schema, scoped at query time.

What They Share

Same primitives, applied at different scales.

We did not build two products on top of two stacks. We built two surfaces on top of one engine. A bug fix in one improves the other. A new detection rule lights up in both. The cost of running both is barely more than the cost of running one.

Building block Fleet Command MSSP Multi-Tenancy
Per-tenant dedicated appliance Each branch runs its own Edge appliance. Each customer runs its own Edge appliance.
Periodic summary publishing Branches publish summaries every 5 min. Customers publish summaries on the same cadence.
Logical tenant grouping (‘scope’) A fleet = a customer’s set of branches. A scope = an analyst’s set of customers.
Edition flag toggles per tenant Fleet Command on or off per branch. MSSP Console on or off per provider.
Forward-compatible identifiers Records stamped with tenant_id and fleet_id. Same records. tenant_id is all the MSSP needs.
How They Differ

Five dimensions tell the products apart.

Fleet Command is a customer-funded view of the customer’s own estate. MSSP Multi-Tenancy is a provider-funded view of many customers’ estates. Same engine, different audience, console, scope, hierarchy and authentication.

Dimension Fleet Command MSSP Multi-Tenancy
Primary audience The customer’s own SOC team. The provider’s analysts.
Console location Embedded in the customer’s primary appliance. Dedicated provider URL, e.g. mssp.edg3.io.
Scope model Fixed. A fleet’s branches are its branches. Dynamic per analyst session, tick on or off.
Hierarchy Flat. One customer to many branches. Recursive. MSSP-of-MSSPs supported natively.
Login & access control Customer’s existing SOC login. Provider login with per-customer ACLs.
MSSP Hierarchy · The Recursive Case

When an MSSP buys an MSSP, scope just nests.

Scope is just a set of tenant_ids attached to an operator session. Add tenants, remove tenants, nest MSSPs under MSSPs. It is all the same primitive. One console. Any depth.

Parent MSSP
Apex Security Group
scope: tenant_id ∈ ALL 8 tenants
MSSP-A
FinServ + Health vertical
scope: tenant_id ∈ {a, b, c, d}
Acme Banktenant_a
Beacon Healthtenant_b
Cobalt Logisticstenant_c
Delta Energytenant_d
MSSP-B
Critical-infra vertical
scope: tenant_id ∈ {e, f, g, h}
Echo Retailtenant_e
Fjord Maritimetenant_f
Gulf Utilitiestenant_g
Helix ICStenant_h

What changes when MSSP buys MSSP

Nothing in the engine. Apex’s analysts see the union of {a..h}. MSSP-A’s analysts still see {a, b, c, d}. MSSP-B’s analysts still see {e, f, g, h}. Apex can also delegate sub-scopes back down. A junior analyst can be given the FinServ-only view without copying any data.

Architecture in One Line

Two products. One foundation.