5. Multi-tenant

Unlike Single-tenant, Multi-tenant will optimize resources and costs while simplifying the process of managing detection rules by environment. The flexibility of the architecture makes it possible to properly refine detection rules, more easily isolate threats and customize capture.

From the GCenter web interface, in the 'SIGFLOW - GCaps Profiles' part, not checking the box 'Enable Multi-tenant monitoring' means that the Ruleset SIGFLOW will be applied to all GCap capture interfaces.

Unchecking this box offers the possibility of assigning different SIGFLOW Rulesets for each of the GCap interfaces and of having different supervision on different networks.

An optimization of the SIGFLOW rules beforehand is obviously recommended before choosing this configuration option. The rules must indeed be adapted to the monitored environment.