You can troubleshoot errors on cloud instances by drilling down on an instance from the Data Sources & Integrations page.
To help you to troubleshoot errors on a cloud instance, Cortex Cloud provides the following visibility and drilldown options:
Overall status of an instance that indicates the health of your instance.
A breakdown of the security capabilities enabled on an instance, detailing the status of each capability along with any open errors or issues.
Additional XQL drill down options to query the history of error and recovery events for each security capability.
Navigate to → .
Under Cloud Service Provider, review the status of the instances that were onboarded for the service provider. If the status shows Warning or Error, hover over the service provider and click View Details.
On the Cloud Instances page review the list of instances that were onboarded and their overall status. The status is displayed as follows:
Connected: The connector is enabled and has no issues.
Warning: The connector is enabled and has minor issues. For example, some accounts or capabilities are in warning or error status.
Error: The connector is enabled and has substantial errors. For example, an authentication failure, an outpost failure, major permissions issues, or (for organization level accounts) the majority of the accounts in the instance are in error status.
Disabled: The connector is disabled.
To understand why an instance is showing a Warning or Error status, click on the instance name.
The cloud instance panel provides a breakdown of the security capabilities and the accounts onboarded on the instance. Review the information in the following sections:
Section
Context
Header
Displays the overall status of the instance and the following information about the account, as specified during onboarding:
Scope of the instance: The number of accounts onboarded on the instance and their status. See the Accounts section for more information about the individual accounts and the type of account (single account or organization).
Scan mode: Cloud Scan or Outpost. For accounts using Outpost, information is displayed about the status of the Outpost account and the account ID.
Resource Tags: Tags defined during onboarding.
Security Capabilities
Displays a breakdown of the security capabilities enabled on the instance and their individual statuses. Click on any item that shows a warning or error status to see the open errors and issues that contributed to the status:
Errors are factual objects that are automatically created when problems occur, and provide insight into the current status of the capability. For example, if a permission is missing, an error is displayed. Browse and filter the errors to better understand and resolve the problem.
Issues are actionable objects that are triggered when detected problems exceed defined thresholds. Issues are manageable, trackable, and provide remediation suggestions and automations.
The issues displayed in the panel are open issues that are specifically related to the selected connector with the selected capability in the observed scope (single account or organization). Click an issue to start investigating it.
Accounts
Lists the accounts that are onboarded on the instance and their individual status.
If multiple accounts are onboarded on the instance, click on each account to filter the page information by account, and drill-down to the security capability statuses for each account.
If the instance shows an Outpost error, go to the All Outposts page and find the outpost account that is being used by this instance. Right click the Outpost account to view the open errors and issues for the account.
If the account shows Permission errors, use the side panel to check which permissions are missing. You can also Edit the instance to redeploy the cloud setup template, which should normally resolve the error.
Further investigate errors by running XQL queries on the
cloud_health_auditingdataset.This dataset records error and recovery events for the security capabilities in cloud instances. By querying this dataset you can see information about when the error started, the prevalence of the error, and whether there is a recurrency pattern. See the specific fields descriptions and query examples for each security capability.
Note
Errors related to collection of audit logs in the cloud instance are recorded in the
collection_auditingdataset. For more information, see Audit logs fields and query examples.Set up correlation rules to trigger issues when errors occur in cloud security capabilities. See the following examples.