Dataspaces

Dataspaces help you to conduct separate investigations, either on the same data set or on different data sets.

Each dataspace can contain different dashboards and visualizations according to what the investigation requires and the reports that you might be expected to produce.

When you log into Siren Investigate, the default dataspace is called HOME. The dataspace you are operating in is called the current dataspace, which contains partitioned data and objects.

You can find the dataspace that you are accessing either by checking the URL, which embeds the short code of the dataspace, or by clicking the dataspace selection button in the left navigation bar.

Identifying the current dataspace

The dataspace selection button opens the dataspace panel, where you can switch to another dataspace by clicking on its short code.

Working with dataspaces

Depending on your user role permissions, you can create, clone, or edit dataspaces.

You can also upload data to the relevant dataspace by using the Excel/CSV import tool.

System administrators can easily partition saved objects and allow different user groups to work in separate dataspaces, according to their organizational role.

The following saved objects can be separated by dataspace:

  • Dashboards

  • Visualizations

  • Data model items, for example:

    • Searches, including index pattern searches

    • Entity identifiers

    • The data model visual layout

  • Watchers

  • Results from Web services that are configured accordingly

The Saved Objects section of the Management screen shows the full list of object types, which are divided between global objects and Current dataspace objects.

You can upload data, such as CSV files, to a specific dataspace in a way that is secure and accessible only to other roles that have access to that dataspace.

When are dataspaces useful?

Dataspaces are generic partitions, so you can use them to create completely independent Siren environments, such as for a multi-tenant environment or to handle different projects.

A typical use of dataspaces, however, is to partition data per investigation, by initially cloning a master dataspace that contains the dashboards that you want to use.

After the dataspace is created, you can customize the visualizations and create new dashboards, which can be saved with specific filters.