Hi @gmbdrj, Enterprise Security isn't multi tenant! You can use as a workaround, to store data of each customer in a different index, but anyway you have to: create different indexes for each customer to identify them (it isn't a great job), manually modify all the searches in Correlation Searches (it isn't a great job), manually modify threat intelligence searches and inputs (very hard job!), manually modify identities and assets (hard job!), create specific dashboard for the customers because it isn't possible to modify the main ES dashboards (it isn't a great job). I did it for some of our customers but it wasn't a simple job and I hint to engage Splunk Professional Services. Ciao. Giuseppe
... View more