A managed security service provider (MSSP) can deploy and maintain Helix for multiple organizations. For security and privacy, each organization requires a separate Helix environment. The Helix federated view Search page has the same features as the standard Search page, but it centralizes alerts across these organizations into a single federated view. This allows you to quickly find and pivot to the highest severity threats to take action on them. You can also search and hunt across organizations and build custom dashboards to compare and aggregate data.
Note
In this content, the MSSP is the parent organization and its managed organizations are child organizations.
On the Search page, you can search one or more customers at a time. In the Selected Customer menu, choose the customers you want to include in the search and then enter your query and run your search. You can take actions on searches for child organizations directly from the federated view search results page. For a single search result, at the end of the row select the option from the More Options menu. For multiple search results, select the checkbox on each row and then select the option from the Actions menu.
Note
Only users with the relevant permissions can see the Helix federated view, run searches on child organizations, and see recently run searches on child organizations.