A managed security service provider (MSSP) can deploy and maintain Helix for multiple organizations. For security and privacy, each organization requires a separate Helix environment. The Helix federated view Alerts page has the same features as the standard Alerts page, but it centralizes alerts across these organizations into a single federated view. This allows you to quickly find and pivot to the highest severity threats to take action on them. You can also search and hunt across organizations and build custom dashboards to compare and aggregate data.
Note
In this content, the MSSP is the parent organization and its managed organizations are child organizations.
Users with federated permissions can take actions on alerts for child organizations directly from the federated view Alerts page. On the Alerts page, for a single alert, at the end of the row select the option from the More Options .png "more-options.png")
menu. For multiple alerts, select the checkbox on each row and then select the option from the Actions menu.