> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-can-i-create-siem-clusters-for-suborganizations-in-enginsight-using-geosplitting.md).

# How can I create SIEM clusters for suborganizations in Enginsight using geosplitting?

Setting up SIEM clusters using geo-splitting allows a main organization that uses the Enginsight SIEM to create a separate SIEM instance for each managed suborganization.

This restricts each suborganization's access to only the SIEM data that relates to that suborganization and helps distribute the load generated by the SIEM. It is also possible to assign multiple suborganizations to one SIEM instance.

Follow these steps to set up a SIEM cluster for selected suborganizations:

{% stepper %}
{% step %}
Install a [new SIEM Management Server](https://docs.enginsight.com/docs/manual/english/installation-und-konfiguration/installation-and-configuration/enginsight-siem/siem-management-server), a [new SIEM Index Server](https://docs.enginsight.com/docs/manual/english/installation-und-konfiguration/installation-and-configuration/enginsight-siem/siem-index-server), and the [Enginsight component Loggernaut](https://docs.enginsight.com/docs/manual/english/installation-und-konfiguration/installation-and-configuration/enginsight-siem/loggernaut) as described in the Enginsight Manual.

{% hint style="warning" %}
**Please note**: Each SIEM cluster requires its own SIEM Management Server, its own SIEM Index Server, and its own Loggernaut!
{% endhint %}
{% endstep %}

{% step %}
Log in to the **SIEM Management Server** of your ***main organization***.
{% endstep %}

{% step %}
Open the **Loggernaut configuration file** using the following command:

```
sudo nano /opt/enginsight/loggernaut/config.json
```

{% endstep %}

{% step %}
Navigate to the `siem` section and add the highlighted `alternatives` section.

{% hint style="warning" %}
**Please note**: You need one `alternatives` section per SIEM cluster.
{% endhint %}

<pre><code>{    
    "api": {...},
    "siem": {
          "basicAuth": {
                    "username": "...",
                    "password": "..."
          },
          "url": "...",
          "management": {
                    "organisation": "&#x3C;MainOrganizationID>"

<strong>          "alternatives": [{
</strong><strong>                   "organisations": ["&#x3C;SubOrganization1ID>", "&#x3C;SubOrganization2ID>"],
</strong><strong>                   "basicAuth": {
</strong><strong>                           "username": "&#x3C;NewSIEMManagementServerUsername>",
</strong><strong>                           "password": "&#x3C;NewSIEMManagementServerPassword>"
</strong><strong>                   },
</strong><strong>                   "url": "&#x3C;NewSIEMManagementServerURL>",
</strong><strong>                   "numShards": 2,
</strong><strong>                   "replicationFactor": 1,
</strong><strong>                   "management": {
</strong><strong>                            "organisation": "&#x3C;MainOrganizationID>"
</strong><strong>                            }
</strong><strong>          }],
</strong>          ...
      }
}
</code></pre>

Replace the placeholders in `<>` as follows:

<table><thead><tr><th width="365.29296875">Placeholder</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;SubOrganization1ID></code></td><td><p>Enter the IDs of one or more suborganizations that you want to move to the corresponding SIEM cluster.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: If you set up multiple SIEM clusters, it is essential that no suborganization appears more than once, meaning it must not exist in two clusters at the same time!</p></div></td></tr><tr><td><code>&#x3C;NewSIEMManagementServerUsername></code></td><td>Enter the username that was automatically generated during the installation of the new SIEM Management Server.</td></tr><tr><td><code>&#x3C;NewSIEMManagementServerPassword></code></td><td>Enter the password that was automatically generated during the installation of the new SIEM Management Server.</td></tr><tr><td><code>&#x3C;NewSIEMManagementServerURL></code></td><td>Enter the URL that points to the new SIEM Management Server.</td></tr><tr><td><code>&#x3C;MainOrganizationID></code></td><td>Enter the ID of your main organization.</td></tr></tbody></table>
{% endstep %}

{% step %}
Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}
{% endstepper %}

***