Namespaces Enterprise
Namespaces partition your Trapster deployment by team, site, region, or project. Every Trapster, incident, and honeytoken belongs to exactly one namespace.
What namespace restriction actually does
Namespace access is enforced on the API, not just hidden in the UI. A user assigned to specific namespaces cannot read or modify data outside those namespaces.
| Scoped resource | What a restricted user sees |
|---|---|
| Incidents | Only incidents in assigned namespaces |
| Trapsters | Only Trapsters in assigned namespaces |
| Honeytokens | Only honeytokens in assigned namespaces |
| Breadcrumbs | Only breadcrumbs tied to Trapsters in assigned namespaces |
| Email alerts | Only incidents in namespaces they can access (see below) |
Administrators have access to all namespaces by default. Everyone else must be assigned one or more namespaces when invited.
The namespace switcher in the sidebar is a convenience filter on top of this. It narrows what you see within the namespaces you already have access to.
Namespace-scoped alerting
Alerting respects namespaces at two levels:
- User email preferences (Settings > Notifications): you only receive emails for incidents in namespaces you can access. Your alert level (all incidents, login/breadcrumb/honeytoken only, or off) applies within that scope.
- Integration targets (Settings > Integrations): each global email address, webhook, and syslog destination can be scoped to all namespaces or selected namespaces. An incident only triggers integrations whose namespace scope includes it.
When to use namespaces
Create separate namespaces when different teams or sites within one organization should operate independently:
- A regional SOC that must not see another region's Trapsters
- A lab or staging environment isolated from production decoys
- Different business units sharing one Trapster license
Namespaces are not full multi-tenant isolation. Everything under one dashboard shares a single organization, license pool, and administrator boundary.
Only Administrators can create, rename, or delete namespaces.
Deleting a namespace
Deleting a namespace permanently removes all Trapsters, incidents, honeytokens, and related data in that namespace. Nothing is archived or reassigned automatically.
The default namespace (marked protected at creation) cannot be deleted. To retire a namespace without losing devices, migrate Trapsters to another namespace first from each Trapster's detail page before deleting the empty namespace.
Destructive action
Namespace deletion is irreversible. Move or export anything you need to keep before deleting.