Skip to main content
Version: 6.1

Service Provider

Overview​

Service Provider (SP) is a SAFarchitecture that combines multiple clusters and enables unified search and analysis across distributed data sources. The central cluster operates as an SP Server, while its connected child clusters operate as SP Clients.

The Service Provider architecture supports the Managed Security Service Provider (MSSP) model, in which client data is stored and processed in separate clusters.

Operating Modes​

A SAF installation can operate in one of the following modes:

  • Disabled — the installation operates independently
  • SP Client — the installation operates as a child cluster and connects to an SP Server
  • SP Server — the installation operates as the central cluster, connects SP Clients, and uses their data

Mode selection is described in Management. Cross-cluster search must be configured before using SP Client or SP Server mode.

Section Contents​

  • Management — selecting a Service Provider mode and reviewing cluster configuration requirements
  • Setting up SP client — creating, editing, and deleting client cluster connections
  • Connected SP Clients — viewing client status and information about client indexes, servers, and storage