IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Need Support for Single Integration Server to Handle Multiple Child Orgs in MSSP Deployment.

  • 1.  Need Support for Single Integration Server to Handle Multiple Child Orgs in MSSP Deployment.

    Posted yesterday

    Hi Team,

    I am working on an MSSP deployment of IBM SOAR where we are using:

    • One SOAR Platform

    • One Configuration Organization

    • Three Child Organizations (3 tenants)

    • One App Host VM

    • One Integration Server VM

    According to the current MSSP architecture documentation, IBM recommends:

    • One Integration Server for the Configuration Organization

    • One Integration Server for each Child Organization

    This results in a total of 4 Integration Servers for our use case.

    However, this becomes a challenge because my client does not agree to deploy multiple Integration Server VMs just to run a small custom app/function. They want to keep the infrastructure minimal and cost-effective.

    Problem:
    I have a custom Python function (custom app) that needs to be used by all three tenants.
    But the current MSSP architecture requires each child organization to have its own Integration Server for the app to execute, even when the logic is identical and shared across tenants.

    Request:
    Please let us know if there is any supported method or recommended approach to run a single Integration Server for multiple child organizations in an MSSP deployment, especially for lightweight custom applications.



    ------------------------------
    Arunkumar G
    ------------------------------


Related Content