Tenants

The Tenants tab appears only if you have enabled Multi-Tenant mode.

Multi-Tenant Options

• Multi-Tenant License Mode: The multi-Tenant license mode can be changed after multi-Tenant is setup, however it is important to note that switching from inherited to per-Tenant will cause existing Tenants to no longer have any licensed module.
• Allow Tenants to use the "Backup" Scheduled Task: Determines if the Backup Scheduled Task should be available to Tenants. In most cases backups should be managed by the database administrator and this option should be left checked.
• Allow Tenants to use the "Run Script" Scheduled Task: Scripts present a potentially dangerous level of access to the system, however the risk can be mitigated because scripts have to be installed on the Manager using file-system access.
• Allow Tenants to run "Computer Discovery" (directly and as a Scheduled Task): Determines if discovery is exposed. This may not be desirable in service provider environments where network discovery has been prohibited.
• Allow Tenants to run "Port Scan" (directly and as a Scheduled Task): Determines if port scans can be executed. This may not be desirable in service provider environments where network scan has been prohibited.
• Allow Tenants to add VMware vCenters: Determines if vCenter connectivity should be exposed. If the deployment is intended for a public service, this option should most likely be disabled since there will not be a route to the vCenter from a hosted service.
• Allow Tenants to add Cloud Accounts: Determines if Tenants can setup cloud sync. This is generally applicable to any deployment.
• Allow Tenants to synchronize with LDAP Directories: Determines if Tenants can setup both User and Computer sync with Directories (LDAP or Active Directory for Computers, Active Directory only for users). If the deployment is intended for a public service, this option should most likely be disabled since there will not be a route to the directory from a hosted service.
• Allow Tenants to configure SNMP settings: Allow Tenants to forward System Events to a remote computer (via SNMP)
• Show Introduction to Tenants (Recommended only if all "add" and "synchronize" options are enabled): Automatically displays the introductory slide show to Tenants when they first sign in. (The slide show can be accessed by clicking the Support link at the top right of the Vulnerability ProtectionDeep Security Manager window and selecting Introduction.)
• Show "Forgot Password?" option: Displays a link on the sign in screen which Users can access to reset their password. (Note that SMTP settings must be properly configured on the Administration > System Settings > SMTP tab for this option to work.)
• Show "Remember Account Name and Username" option: Vulnerability ProtectionDeep Security will remember the User's Account Name and Username and populate these fields when the sign in screen loads.
• Allow Tenants to control access from Primary Tenant: By default, the Primary Tenant can sign in to a Tenant's account by using the Sign In As Tenant option on the Administration > Tenants page. When the Allow Tenants to control access from Primary Tenant option is selected, Tenants are given the option (under Administration > System Settings > Advanced in their ) to allow or prevent access by Primary Tenant to their Deep Security environment. (When this option is enabled, the default setting in the Tenant's environment is to prevent access by the Primary Tenant.)
  Whenever the Primary Tenant accesses a Tenant's account, the access is recorded in the Tenant's System Events.
• Allow Tenants to use the Relays in my "Default Relay Group" (for unassigned Relays): gives Tenants automatic access to relays setup in the primary Tenant. This saves Tenants from having to setup dedicated Relays for Security Updates.
  Tenants can reject the usage of "shared" Relays by going to the Updates tab on the Administration > System Settings page and deselecting the Use the Primary Tenant Relay Group as my Default Relay Group (for unassigned Relays) option. If Tenants deselect this setting they must set up dedicated Relays for themselves.
  When Relays are shared, it is the responsibility of the Primary Tenant to keep the Relays up to date. This usually involves creating Download Security Update Scheduled Tasks for all Relays at a regular intervals.
• New Tenants automatically download the latest Security Updates: As soon as you create a new Tenant account, it will check for and download the latest available Security Updates.

• Lock and hide the following (all Tenants will use the options configured for the primary Tenant):
  • Data Privacy options on the "Agents" Tab: Allows the Primary Tenant to configure data privacy settings. (This setting only applies to "Allow Packet Data Capture on Encrypted Traffic (SSL)" in on the Administration > System Settings > Agents tab.)
  • All options on the "SIEM" Tab (All Tenants use the settings located on the SIEM tab for ALL event types and syslog is relayed via the Manager): Allows the primary Tenant to configure syslog for all Tenants at once. In CEF format the Tenant name is included as TrendMicroDsTenant .
  • All options on the "SMTP" Tab: Locks all settings on the SMTP tab.
  • All options on the "Storage" Tab: Locks all settings on the Storage tab.

Database Servers

By default all Tenants will be created on the same database server Vulnerability ProtectionDeep Security Manager was installed with. In order to provide additional scalability Vulnerability ProtectionDeep Security Manager supports adding additional database servers.

For SQL Server the secondary database server requires a hostname, username and password (domain and named instance are optional). The TCP/Named Pipes setting has to be the same as the primary database (TCP is always recommended). The user (the Vulnerability ProtectionDeep Security Manager) must have the following permissions:

• create databases,
• delete databases and
• define schema.

This account is used not only to create the database but to authenticate to the databases that are created.

Oracle Multi-Tenant uses a different model. The new database definition defines a user that is bound to a tablespace. That user is used to "bootstrap" the creation of additional users on Oracle.

For information on setting up database user accounts for multi-tenancy see Multi-Tenancy.

Database servers (other than the primary) can be deleted provided there are no Tenants located on the server.

If the hostname, username, password or any details change the GUI can be used to change for database servers (other than the primary). To change values for the primary the Vulnerability ProtectionDeep Security Manager must be shutdown (all nodes) and the dsm.properties file edited with the new details.

New Tenant Template

The Tenant Template feature provides a convenient way of creating a customized "out-of-the-box" experience for new Tenants.

The process involves:

1. Creating a new Tenant
2. Logging in as that Tenant
3. Customizing the example Policies (adding/removing/modifying) and the Security Update version (applying newer versions)
4. Return to the primary Tenant and run the Tenant template wizard
5. Select the Tenant to snapshot

All future Tenants will have the example policies and rule update version included in the snapshot.

This feature may be useful in service provider environments where some of the examples are not applicable, or special examples need to be created.

As always the examples are meant to be a starting point. Tenants are encouraged to create policies based on their unique needs.

Protection Usage Monitoring

Vulnerability ProtectionDeep Security collects information about protected computers. This information is visible on the Dashboard in the Tenants widget and the Tenant Protection Activity widget. The information is also provide in the Tenant Report and is available via the REST API.

Use these options determine which additional additional Tenant computer details are recorded.