Whether you manage 5 tenants or 500, ContraForce scales with your business. All multi-tenant features are included in the platform at no additional cost.
Why Multi-Tenant Matters
Traditional security tools force analysts to log into each customer environment separately. ContraForce eliminates this friction:Single Pane of Glass
View all customer incidents in one unified dashboard
Consistent Workflows
Same response process across every tenant
Efficient Staffing
One analyst can manage more customers effectively
Command Dashboard: Your Central Hub
The Command Dashboard is the heart of ContraForce’s multi-tenant capabilities. It provides a unified view of all security incidents across your managed tenants.
What You Can See
| Card | Multi-Tenant Capability |
|---|---|
| Incident Tracker | High severity and total incident counts per workspace |
| Latest Gamebook Activity | Recent response actions across all tenants |
| Data Connector Anomalies | Connector health issues by workspace |
| Incidents Table | All incidents from all tenants in one view |
Default Behavior
By default, the Command Page displays data for all onboarded tenants. This gives you immediate visibility into your entire customer base without any configuration.Workspace Filtering
While seeing everything is powerful, sometimes you need to focus. The Workspace Filter lets you customize your view.How It Works
1
Open the Filter
Click the workspace dropdown in the top navigation bar
2
Select Workspaces
Check the workspaces you want to display (one, several, or all)
3
View Filtered Data
All dashboard cards and tables update to show only selected workspaces
Filter Persistence
Your workspace selection persists as you navigate between pages in ContraForce:- Command Page → Endpoints Page → Gamebooks Page
- Your selected workspaces remain active throughout your session
- No need to re-select filters on each page
This persistence is especially useful when you’re focused on a specific customer’s issues and need to investigate across multiple ContraForce features.
Additional Filters
Beyond workspace filtering, you can further refine the Incidents table by:| Filter | Options | Use Case |
|---|---|---|
| Severity | High, Medium, Low, Informational | Prioritize critical incidents |
| Status | New, Active, Closed | Focus on open investigations |
| Module | Sentinel, Defender XDR | Filter by security product |
Multi-Tenant Incident Management
Managing incidents across tenants follows the same workflow—but with added context about which customer is affected.Incident Table Columns
The Incidents table includes workspace identification:| Column | Description |
|---|---|
| Severity | Incident severity level |
| Workspace | Which customer/tenant the incident belongs to |
| Incident Title | Description of the incident |
| Incident ID | Unique identifier (click to investigate) |
| Creation Time | When the incident was detected |
| Status | Current investigation state |
| Owner | Assigned analyst |
Bulk Operations Across Tenants
You can perform bulk actions on incidents from multiple tenants simultaneously:1
Select Incidents
Check incidents from any combination of workspaces
2
Click Update Incidents
Open the bulk action dialog
3
Apply Changes
Assign owner, change status, or close—all in one action
Multi-Tenant Endpoint Management
The Endpoints Page extends multi-tenant visibility to your device inventory.Unified Device View
See all endpoints from all tenants in a single table:| Column | Description |
|---|---|
| Workspace | Which customer owns the device |
| Device Name | Endpoint hostname |
| Exposure Level | Risk assessment from Defender |
| OS Platform | Windows, macOS, Linux, etc. |
| Health State | Device health status |
| Last Seen | Most recent check-in time |
Cross-Tenant Endpoint Actions
Run Defender for Endpoint actions on any device, regardless of tenant:- Isolate device
- Run antivirus scan
- Collect investigation package
- Restrict app execution
Multi-Tenant Gamebook Activity
Track automated response actions across your entire customer base.Gamebook Activity Card
The Command Page shows Latest Gamebook Activity with:- Workspace — Which customer the action was performed on
- Status — Success, Failed, Pending Approval
- Incident — Linked incident ID
- Owner — Who initiated the action
Approval Workflows
When Gamebook actions require approval, you can manage all pending requests from one location:- Navigate to the Gamebook Activity tab
- View pending approvals across all tenants
- Approve or reject with full context
Workspace Management
The Workspaces Page provides administrative control over your tenants.Pre-Onboarding
Prepare customer environments before full deployment:- Create workspace placeholders
- Configure initial settings
- Streamline the onboarding process
Post-Onboarding Management
After onboarding, manage workspace configurations:- View onboarding status
- Access workspace settings
- Monitor integration health
Learn More
Complete guide to the Workspaces Page
Best Practices for Multi-Tenant Operations
Establish naming conventions
Establish naming conventions
Use consistent workspace names that clearly identify customers. This makes filtering and incident triage faster.
Create tiered response procedures
Create tiered response procedures
Define which incident types require immediate attention vs. scheduled review. Use severity filtering to prioritize.
Assign dedicated analysts per customer segment
Assign dedicated analysts per customer segment
For large deployments, consider assigning analysts to specific workspace groups to build customer familiarity.
Review the Command Page daily
Review the Command Page daily
Start each day with a Command Page review across all tenants to catch emerging issues early.
Monitor connector health proactively
Monitor connector health proactively
Don’t wait for incidents to reveal data flow problems. Check Data Connector Anomalies regularly.
Related Guides
Command Page
Deep dive into the central dashboard
Incident Management
Complete incident workflow guide
Workspaces Page
Manage tenant configurations
Endpoint Management
Device inventory and actions
Questions about multi-tenant features? Contact us at [email protected].