What an organization is
An organization is a tenant: typically one legal entity you protect. Every event, alert, case, host, ingest key and report belongs to exactly one organization. A single-company deployment has one; a provider has one per customer.
Per-organization settings
Settings › Organizations holds, per organization:
| Setting | Effect |
|---|---|
| Details | Name, identifier, contact, whether it is a customer, and the retention tier chosen at creation. |
| SLA targets | Respond and resolve targets per severity. See SLA. |
| Coverage and time zone | 24x7 or business hours, and when an SLA warning fires. |
| Notification routing | Extra operator and customer recipients, muted kinds, customer quiet hours. |
| Automation guardrails | What playbooks may do automatically. See Modes and ceilings. |
| Customer portal | Whether the portal is enabled, portal accounts, and the logo, note and support contact it shows. |
| Isolation notice | What the user of an isolated host is told. |
Ingest keys, installer bundles and fleet groups are managed on their own pages, always scoped to the organization. An organization with no settings saved runs on the deployment defaults.
Scoping
Analysts are granted some organizations or all of them. Every query in the console is scoped to the analyst's grants; a resource outside the grant answers as if it did not exist. The organization switcher in the top bar narrows the view further to one organization or shows all granted ones.
Creating and removing
Create an organization with a name, an identifier and a retention tier. The identifier must match the organization your ingest sends, and the tier cannot be changed later. Removing an organization hides it from the console; its telemetry, alerts and cases are kept.