Case Study · Systems & Integrations

Payment security Tenant-separated monitoring for several merchant environments

Partner project by Innowise

Project profile

CustomerNot named
PartnerInnowise
IndustryFinancial services / payments

Challenge

A payment service provider supports several merchants, each with their own systems and IT teams. As the number of environments grew, security monitoring had to become centrally manageable without giving up the separation of merchant data. Added to this were requirements for daily log reviews and traceable evidence under PCI DSS 4.0.

Solution

One platform, separate data views

Innowise combined Wazuh agent groups, role-based access rights and separate index patterns. Merchants see only their own logs, alerts and reports. The central SOC retains the cross-tenant view.

Review, then escalate selectively

Custom rules capture failed logins, file changes and administrative actions, among other events. Reviewed incidents are passed to the merchant team responsible. Automated reports support daily, weekly and monthly reviews.

Tenant separation with a central SOC view

Merchant A: Own events → Area A: Logs & reports; Merchant B: Own events → Area B: Logs & reports; Merchant C: Own events → Area C: Logs & reports; Area A: Logs & reports → Central SOC: Authorized overall view; Area B: Logs & reports → Central SOC: Authorized overall view; Area C: Logs & reports → Central SOC: Authorized overall view.

Technologies

Wazuh / OpenSearch
Docker / Kubernetes
PostgreSQL / REST APIs

Results

According to the partner documentation, the effort for reporting fell by 75 %. The solution supports the stated log monitoring and daily review requirements from PCI DSS Requirement 10. No statement about full PCI DSS certification of all merchants follows from this.

75 % less reporting effort
Separate data views per merchant
Targeted escalation