# OpenSearch Guide

The OpenSearch project, created by Amazon, is a forked search project based on old versions of Elasticsearch and Kibana. These projects were created primarily to support Amazon OpenSearch Service (formerly Amazon Elasticsearch Service).

It only takes a few minutes to get started with Satori. What you need is:
- Access to Satori's management console.
- The hostname of your OpenSearch data store, for example: `my-data-store-6tajyuykpzegcu27vtv5xk7lf.us-east-1.es.amazonaws.com`

## Adding an OpenSearch Data Store to Satori

Perform the following steps to add an OpenSearch data store to your Satori account:

1. Login to the [**Satori Management Console**](https://app.satoricyber.com/).
2. In the **Data Stores view**, click the plus button to **add a new data store**.
3. Select the **OpenSearch** option.
4. Enter an **informative name** for the data store, for example: Sales Data Warehouse.
5. Enter the **Hostname** of your OpenSearch database, for example: `my-data-store-6tajyuykpzegcu27vtv5xk7lf.us-east-1.es.amazonaws.com`
6. Choose a **Data Access Controller** to use for this data store by selecting the **Cloud provider** and **Region**.
7. Click the **Add New Data Store** button.
8. You will be redirected to the **Data Stores list view**.

## The OpenSearch Project

The openSerch project is an open source project that contains two main parts:

- The open-search-dashboard
- The open-search-server

Satori currently supports a locally deployed dashboard on a client environment.

## Setting up your OpenSearch Dashboard

To connect to the OpenSearch Dashboard using Satori go the OpenSearch dashboard settings file and set the hostname with the Satori hostname that was generated by the management console.

Click on the newly created **OpenSearch data store instance** in the Satori management console and copy the **Satori Hostname URL** for example:`open-search-stage.us-east-1.a.s0.satoricyber.net` and then paste it to the OpenSearch dashboard settings.

### Okta SAML Authentication

Satori supports SAML authentication that enables you to connect to the Open Search data store via satori. Okta acts as the SAML IdP and uses SSO and MFA to authenticate the user.

Perform the following steps to configure Okta SAML authentication on Okta.

1. Go to **SAML Settings** in Okta
2. Uncheck the **Use this for Recipient URL and Destination URL** checkbox
3. Set the SSO URL to the following: `Https://open-search-stage.us-east-1.a.s0.satoricyber.net:5601 /_opendistro/_security/saml/acs`
4. Go the **Recipient URL** input field and enter the Amazon URL: `Https://my-data-store-6tajyuykpzegcu27vtv5xk7lf.us-east-1.es.amazonaws.com:5601 /_opendistro/_security/saml/acs`
5. Now go to the **Destination URL** input field and enter the same URL: `Https://my-data-store-6tajyuykpzegcu27vtv5xk7lf.us-east-1.es.amazonaws.com:5601 /_opendistro/_security/saml/acs`
6. Go to the **amazon opensearch instance** and select the **security configuration** section and select **Service provider Entity ID**.
7. Now paste this **Service provider entity ID** in the **Audience URI (SP entity ID)** input field.
8. Now save the **Okta configuration** and login to your **opensearh dashboard instance**.

## Known Limitations

- Only search requests are supported. Other requests are not audited or controlled by Satori.
- Access control is supported at the data store level, i.e. controlling access to specific indices or index patterns is not supported.