Verifying collector connectivity - Administrator Guide - Cortex XDR - Cortex

Verifying collector connectivity - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

Creation date

2024-03-06

Last date published

2024-10-10

Troubleshooting collector errors

Each status change of an instance is logged in the collection_auditing dataset. Querying this dataset can help you see all the connectivity changes of an instance over time, the escalation or recovery of the connectivity status, and the error, warning, and informational messages related to status changes.

Example 47.

This example searches for status changes on Strata IOT integrations:

dataset = collection_auditing 
|filter collector_type = "STRATA_IOT"

You can create correlation rules that are based on the fields in the collection_auditing dataset.

Example 48. Example: Trigger collection alerts for error statuses on the STRATA_IOT collector

In this example, a correlation rule triggers an alert if an integration of the Strata IOT collector changes to error status.

Example XQL:

dataset = collection_auditing 
|filter classification = "Error" and collector_type = "STRATA_IOT"

Additional fields to specify in the correlation rule:

Field	Value
Time Schedule	Hourly
Query time frame	1 Hour
Alert Suppression	Select Enable alert suppression.
Action	Select Generate alert.
Severity	Medium
Category	Collection